> Source: [sk183394](https://support.checkpoint.com/results/sk/sk183394)

# sk183394 - Check Point response to CVE-2025-32728 - The SSH directive "DisableForwarding" fails to disable "X11 Forwarding" and "Agent Forwarding"

| Property | Value |
|----------|-------|
| Solution ID | sk183394 |
| Date Created | 2025-04-27 |
| Last Modified | 2025-12-18 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server, Scalable Platforms |
| Versions | R82, R81.20, R81.10 (EOS), R82, R81.20, R81 (EOS), R82, R81.20, R81.10 (EOS), R81 (EOS), R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- A flaw was found in OpenSSH - in affected versions of SSHD, the directive "`DisableForwarding`" does not fully adhere to the intended functionality as documented.

Specifically, it fails to disable X11 and Agent forwarding, which may allow unintended access under certain configurations.

This issue received the ID [CVE-2025-32728](https://access.redhat.com/security/cve/cve-2025-32728).

## Solution

### Important Notes

* The default SSH configuration in the Gaia OS:

  1. The parameter "`X11Forwarding`" is disabled explicitly.  
     The explicit configured value is "`no`".
  2. The parameter "`AllowAgentForwarding`" is enabled implicitly.  
     The parameter line is commented out.  
     Therefore, the Gaia OS uses the default built-in value of "`yes`".
* Installation of any Jumbo Hotfix Accumulator Take or upgrade to a higher version will restore the default Gaia OS configuration (will implicitly enable the parameter "`AllowAgentForwarding`" again).

  **Therefore, you must perform this procedure again.**

  Reason: The Gaia OS uses the SSH configuration from the Red Hat OS. In the Red Hat OS, this parameter line is commented out, and the built-in value of this parameter is "`yes`" ([see this Red Hat article](https://access.redhat.com/security/cve/cve-2025-32728)).
* In a Cluster, you must configure all cluster members in the same way.

* In a Scalable Platform Security Group (Maestro / Scalable Chassis), you must connect to the Security Group.

* In Quantum Spark Appliances (SMB), starting with R82.00.00, these configuration changes are included by default to address this vulnerability. No manual action is required.

* Various network scanners / vulnerability scanners only check the version of the OpenSSH package and not the actual SSH configuration. As a result, such scanners will report the Gaia OS server as vulnerable.  
  The only correct method to check if the Gaia OS is vulnerable is to use this command as described in the procedure below:  
  `sshd -T -C addr=localhost | grep -i "<Name of Parameter>"`

  The only correct method to check if a Quantum Spark Appliance (SMB) is vulnerable is to use this command as described in the procedure below:

  `/pfrm2.0/bin/sshd -T -f /pfrm2.0/etc/sshd_config -C addr=localhost | grep -i " `"

This problem was fixed. The fix is included in:

* [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 44
* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 119
* [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 183

<br />

If you choose not to upgrade, follow this **workaround** procedure:

### Procedure

To mitigate this vulnerability, make sure these two parameters are disabled explicitly in your SSH configuration:

1. Connect to the command line on the Gaia OS server (Security Gateway / each Cluster Member / Security Group / Security Management Server / Log Server / Quantum Spark Appliances (SMB) ).

2. Log in.

3. If the default shell is Gaia Clish / Gaia gClish, then go to the Expert mode:

   `expert`
4. Back up the current SSH configuration file:

   * In versions R81 and higher, R80.40 Jumbo Hotfix Take 83 (and higher), run:

     * On a Security Gateway / each Cluster Member / Security Management Server / Log Server:

       `cp -v /etc/ssh/templates/sshd_config.templ{,_BKP}`
     * On a Security Group (ElasticXL / Maestro / Scalable Chassis):

       `g_all cp -v /etc/ssh/templates/sshd_config.templ{,_BKP}`
   * In versions R80.40 Jumbo Hotfix Take 78 and lower, R80.30SP, R80.30 and lower, run:

     * On a Security Gateway / each Cluster Member / Security Management Server / Log Server:

       `cp -v /etc/ssh/sshd_config{,_BKP}`
     * On a Security Group (ElasticXL / Maestro / Scalable Chassis):

       `g_all cp -v /etc/ssh/sshd_config{,_BKP}`
   * On Quantum Spark Applliances (relevant for all SMB versions):

     `cp -v /pfrm2.0/etc/sshd_config{,_BKP}`
5. Edit the current SSH configuration file:

   * In versions R81 and higher, R80.40 Jumbo Hotfix Take 83 (and higher), run:

     `vi /etc/ssh/templates/sshd_config.templ`
   * In versions R80.40 Jumbo Hotfix Take 78 and lower, R80.30SP, R80.30 and lower, run:

     `vi /etc/ssh/sshd_config`
   * On Quantum Spark Appliances (SMB), run:

     `` `vi /pfrm2.0/etc/sshd_config```
6. For these two parameters - remove the "`#`" character in the beginning (if it appears) and configure the value "`no`":

   `X11Forwarding `no

   `AllowAgentForwarding `no
7. Save the changes in the file and exit Vi editor.

8. On a Security Group (ElasticXL / Maestro / Scalable Chassis), copy the modified file to all Security Group Members:

   * In versions R81 and higher, run:

     `asg_cp2blades -b all /etc/ssh/templates/sshd_config.templ`
   * In versions R80.30SP and R80.20SP, run:

     `asg_cp2blades -b all /etc/ssh/sshd_config`
   * **This step is not relevant for SMB.**

9. Only in versions R81 and higher, R80.40 Jumbo Hotfix Take 83 and higher - import the changes from the template file into the running Gaia OS configuration:

   * On a Security Gateway / each Cluster Member / Security Management Server / Log Server:

     `/bin/sshd_template_xlate < /config/active`
   * On a Security Group (ElasticXL / Maestro / Scalable Chassis):

     `g_all /bin/sshd_template_xlate < /config/active`
   * **This step is not relevant for SMB.**

10. Restart the SSH server:

    **Important** - Perform this step only from a LOM Card or from a Console port connection.
    * The restart of the SSH server will disconnect your SSH connection.
    * If you accidentally made a mistake in the SSH configuration file syntax, then you would not be able to connect over SSH.

    Steps:
    * On a Security Gateway / each Cluster Member / Security Management Server / Log Server:

      1. Restart the SSH server:

         `service sshd restart`
      2. Make sure the SSH server started and is active:

         `service sshd status`
    * On an ElasticXL / Maestro / Scalable Chassis:

      1. Determine which Security Group Member runs the SMO Task:

         `asg stat -i tasks`
      2. Connect to the console port on the Security Group Member that runs the SMO Task.

      3. Log in.

      4. If the default shell is Gaia gClish, then go to the Expert mode:

         `expert`
      5. Restart the SSH server:

         `g_all service sshd restart`
      6. Make sure the SSH server started and is active:

         `g_all service sshd status`
    * On Quantum Spark Appliances (SMB), run:

      ```killall sshd && /pfrm2.0/bin/sshd -f /pfrm2.0/etc/sshd_config -p 22 -D```
11.
    * Make sure the Gaia OS uses the value "`no`" for the two parameters:

      `sshd -T -C addr=localhost | grep -i "X11Forwarding"`

      `sshd -T -C addr=localhost | grep -i "AllowAgentForwarding"`
    * Commands for SMB:

      ```/pfrm2.0/bin/sshd -T -f /pfrm2.0/etc/sshd_config -C addr=localhost | grep -i "X11Forwarding"` ``

      ```/pfrm2.0/bin/sshd -T -f /pfrm2.0/etc/sshd_config -C addr=localhost | grep -i "AllowAgentForwarding"```

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content