Ensure bluetooth services are not in use

MediumLevel 1Automatedlinux

Description

Bluetooth is a short-range wireless technology standard that is used for exchanging data between devices over short distances. It employs UHF radio waves in the ISM bands, from 2.402 GHz to 2.48 GHz. It is mainly used as an alternative to wire connections.

How it is checked

Audit method: Shell command

shell

alt0() { command -v rpm >/dev/null 2>&1 || { echo "step1: rpm not installed"; return 1; }; o=$(bash -c 'rpm -q bluez' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'package bluez is not installed' || { echo step1: missing 'package bluez is not installed'; return 1; }; }; alt1() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; command -v systemctl >/dev/null 2>&1 || { echo "step1: systemctl not installed"; return 1; }; o=$(bash -c 'systemctl is-enabled bluetooth.service 2>/dev/null | grep '"'"'enabled'"'"'' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; command -v systemctl >/dev/null 2>&1 || { echo "step2: systemctl not installed"; return 1; }; o=$(bash -c 'systemctl is-active bluetooth.service 2>/dev/null | grep '"'"'^active'"'"'' 2>/dev/null); [ -z "$o" ] || { echo "step2: $o" | head -c 300; return 1; }; }; if alt0 || alt1; then echo compliant; fi

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Run the following commands to stop bluetooth.service, and remove the bluez package: # systemctl stop bluetooth.service # dnf remove bluez - OR - - IF - the bluez package is required as a dependency: Run the following commands to stop and mask bluetooth.service: # systemctl stop bluetooth.service # systemctl mask bluetooth.service Note: A reboot may be required

Properties

Operating systems: almalinux-8
Tags: cis-convertedlinux
Reference: CIS AlmaLinux OS 8 Benchmark v4.0.0 - 3.1.3

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target linux