# Ensure sshd DisableForwarding is enabled

The `DisableForwarding` setting in the SSH server configuration is a critical security control that prevents various types of traffic tunneling, such as TCP forwarding (port forwarding), X11 forwarding, and agent forwarding. When enabled (`yes`), it mitigates the risk of an attacker using a compromised SSH session as a pivot point to access other systems on the internal network. This effectively turns the SSH server into a bastion host that only allows direct interaction, rather than acting as a proxy. Misconfiguration leaves the internal network vulnerable to lateral movement attacks originating from a single compromised account with SSH access. The audit script inspects the `/etc/ssh/sshd_config` file to verify the current setting, while the remediation script ensures the configuration is explicitly set to `DisableForwarding yes` and reloads the SSH service to enforce it. The recommended state at all security levels (Basic, Moderate, and Strict) is `['yes']` because there is no secure use case for allowing SSH forwarding on a hardened server. It is a foundational security measure that should be universally applied to limit the potential attack surface.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['yes']` |
| **Moderate** | `['yes']` |
| **Strict** | `['yes']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the `/etc/ssh/sshd_config` file for the `DisableForwarding` setting. The script must parse the file to determine the effective state of the setting. It should output 'yes' if `DisableForwarding` is explicitly set to 'yes', and 'no' otherwise (if it's set to 'no', commented out, or absent, as the default is 'no'). The output must consist solely of the value.

## Remediation Script Working

Bash script that accepts a single positional argument, which must be 'yes'. The script must modify the `/etc/ssh/sshd_config` file to set `DisableForwarding` to the provided value. If the setting already exists (either active or commented out), it should be updated. If it does not exist, it should be added to the file. After successfully modifying the configuration, the script must reload the sshd service to apply the changes. It must output 'true' upon success and 'false' upon failure.

