# Ensure sshd DisableForwarding is enabled

Necessity: SSH forwarding allows a user to tunnel network connections (TCP, X11, etc.) through the SSH server. While useful, this capability can be exploited to bypass network firewalls and access controls, creating unauthorized communication channels into or out of a secure network. Disabling forwarding is a critical security measure to prevent the SSH server from being used as a pivot point for attacks or data exfiltration. Auditing and Remediation: The audit script directly queries the running SSH daemon's effective configuration to determine if forwarding is disabled. The remediation script modifies the primary SSH configuration file, '/etc/ssh/sshd_config', to explicitly set 'DisableForwarding yes' and then reloads the service to enforce the policy. Recommended State Rationale: Basic: ['yes']. Disabling forwarding is the baseline recommendation according to security standards like the CIS Benchmarks. It closes a significant potential security hole with minimal impact on standard administrative use. Moderate: ['yes']. There is no effective intermediate state for this control; it is either enabled or disabled. Therefore, the moderate recommendation is the same as the basic secure state. Strict: ['yes']. For a high-security environment, there is no justification for allowing SSH forwarding. The strictest configuration is to ensure it is unequivocally disabled, aligning with the basic and moderate recommendations as this is a foundational security setting.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['yes']` |
| **Moderate** | `['yes']` |
| **Strict** | `['yes']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that queries the active SSH server configuration for the 'disableforwarding' directive using the 'sshd -T' command. The script must parse the output and print only the value associated with the directive (e.g., 'yes') to standard output, with no additional text or labels.

## Remediation Script Working

bash script that accepts a single positional argument, which is the desired state for the 'DisableForwarding' directive (e.g., 'yes'). The script must modify the '/etc/ssh/sshd_config' file to set the 'DisableForwarding' directive to the provided value. If the directive exists but is commented out, it should be uncommented and set. If it does not exist, it should be added. After modifying the file, the script must reload the sshd service to apply the changes. It should output 'true' on success and 'false' on failure.

