Detections
Analytics

2.1.1 Ensure autofs services are not in use

Information

autofs allows automatic mounting of devices, typically including CD/DVDs and USB drives.

With automounting enabled anyone with physical access could attach a USB drive or disc and have its contents available in the system even if they lacked permissions to mount it themselves. Requiring an administrator to manually mount media can be part of a defense-in-depth strategy that reduces the risk of unapproved software or information being introduced, or proprietary software or information being exfiltrated.

Solution

Run the following commands to stop autofs.service and remove autofs package:

# systemctl stop autofs.service
# dnf remove autofs

- OR -

- IF - the autofs package is required as a dependency:

Run the following commands to stop and mask autofs.service :

# systemctl stop autofs.service
# systemctl mask autofs.service

Impact:

The use of portable hard drives is very common for workstation users. If your organization allows the use of portable storage or media on workstations and physical access controls to workstations is considered adequate there is little value add in turning off automounting.

There may be packages that are dependent on the autofs package. If the autofs package is removed, these dependent packages will be removed as well. Before removing the autofs package, review any dependent packages to determine if they are required on the system.

- IF - a dependent package is required: stop and mask the autofs.service leaving the autofs package installed.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: IDENTIFICATION AND AUTHENTICATION, MEDIA PROTECTION, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|IA-3, 800-53|MP-7, 800-53|SI-3, CSCv7|8.5

Plugin: Unix

Control ID: af747cae2824faac108860f0c9512f7e4676f7223463bb046d7459370e51a173