How to Completely Disable ‘X11 Forwarding’ in SSH on Ubuntu Server

X11 Forwarding is a feature within the Secure Shell (SSH) protocol that allows users to run graphical applications on a remote Linux server and display the interface on their local machine. While useful for specific administrative tasks, leaving X11 Forwarding enabled on an Ubuntu Server presents a significant security risk. If a malicious actor compromises the server, they could potentially hijack the forwarded X11 session to capture keystrokes or inject commands into the client’s local X server environment.

This guide explains how to completely disable X11 Forwarding in the SSH daemon configuration on Ubuntu Server to harden your network infrastructure against lateral movement attacks.

Disable X11 Forwarding in the SSH Daemon Configuration

To eliminate this vulnerability, you must modify the primary OpenSSH server configuration file and explicitly explicitly reject all X11 forwarding requests.

1. Open your terminal and connect to your Ubuntu Server via SSH.
2. Open the SSH daemon configuration file using a text editor such as nano with root privileges:

   sudo nano /etc/ssh/sshd_config

3. Scroll through the file to locate the X11Forwarding directive. By default, it may be set to yes or commented out with a hash symbol (#).
4. Modify the line to explicitly deny forwarding by setting it to no. Ensure any preceding hash symbol is removed so the directive is active:

   X11Forwarding no

Restart the SSH Service to Apply Changes

Modifications to the sshd_config file do not take effect immediately. You must restart the SSH service to enforce the new security parameters.

1. Save the changes and exit the text editor (in nano, press Ctrl+O, Enter, then Ctrl+X).
2. Restart the SSH daemon to apply the configuration change:

   sudo systemctl restart ssh

3. To verify that the service restarted successfully without syntax errors, check its status:

   sudo systemctl status ssh

Once the SSH daemon has been restarted, any attempt by a client to connect with the -X or -Y flags will be strictly rejected by the server, effectively eliminating the risk of X11-based session hijacking.