Linux: SSH GatewayPorts

# SPDX-FileCopyrightText: 2020 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.150230");
  script_version("2023-07-27T05:05:09+0000");
  script_tag(name:"last_modification", value:"2023-07-27 05:05:09 +0000 (Thu, 27 Jul 2023)");
  script_tag(name:"creation_date", value:"2020-05-07 06:49:26 +0000 (Thu, 07 May 2020)");
  script_tag(name:"cvss_base", value:"0.0");
  script_tag(name:"cvss_base_vector", value:"AV:L/AC:H/Au:S/C:N/I:N/A:N");
  script_tag(name:"qod", value:"97");

  script_name("Linux: SSH GatewayPorts");

  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2020 Greenbone AG");
  script_family("Policy");
  script_dependencies("compliance_tests.nasl", "read_sshd_config.nasl");
  script_mandatory_keys("Compliance/Launch");

  script_add_preference(name:"Value", type:"radio", value:"no;yes;clientspecified", id:1);

  script_xref(name:"URL", value:"https://linux.die.net/man/5/sshd_config");

  script_tag(name:"summary", value:"GatewayPorts: Specifies whether remote hosts are allowed to connect to ports
  forwarded for the client. By default, sshd binds remote port forwardings to the loopback address.
  This prevents other remote hosts from connecting to forwarded ports. GatewayPorts can be used to
  specify that sshd should allow remote port forwardings to bind to non-loopback addresses, thus
  allowing other hosts to connect. The argument may be 'no' to force remote port forwardings to be
  available to the local host only, 'yes' to force remote port forwardings to bind to the wildcard
  address, or 'clientspecified' to allow the client to select the address to which the forwarding is
  bound.");

  exit(0);
}

include("policy_functions.inc");

cmd = "grep '^GatewayPorts' /etc/ssh/sshd_config";
title = "SSH GatewayPorts";
solution = "Edit /etc/ssh/sshd_config";
test_type = "SSH_Cmd";
default = script_get_preference("Value", id:1);

if(get_kb_item("linux/mount/ERROR")){
  value = "Error";
  compliant = "incomplete";
  comment = "Could not read /etc/ssh/sshd_config";
}else{
  value = get_kb_item("Policy/linux/sshd_config/gatewayports");
  compliant = policy_setting_exact_match(value:value, set_point:default);
  comment = "";
}

policy_reporting(result:value, default:default, compliant:compliant, fixtext:solution,
  type:test_type, test:cmd, info:comment);
policy_set_kbs(type:test_type, cmd:cmd, default:default, solution:solution, title:title,
  value:value, compliant:compliant);

exit(0);