3.1.2 Ensure wireless interfaces are disabled

Information

Wireless networking is used when wired networks are unavailable.

Rationale:

If wireless is not to be used, wireless devices should be disabled to reduce the potential attack surface.

Impact:

Many if not all laptop workstations and some desktop workstations will connect via wireless requiring these interfaces be enabled.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Run the following script to disable any wireless interfaces:

#!/bin/bash

if command -v nmcli >/dev/null 2>&1 ; then
nmcli radio all off
else
if [ -n '$(find /sys/class/net/*/ -type d -name wireless)' ]; then
mname=$(for driverdir in $(find /sys/class/net/*/ -type d -name wireless | xargs -0 dirname); do basename '$(readlink -f '$driverdir'/device/driver/module)';done | sort -u)
for dm in $mname; do
echo 'install $dm /bin/true' >> /etc/modprobe.d/disable_wireless.conf
done
fi
fi

See Also

https://workbench.cisecurity.org/files/3490

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|15.4, CSCv7|15.5

Plugin: Unix

Control ID: dd7ef846d0fd992492bb738337550c36b21d82f0176f98a032bfb3ff30947110