TMA-ROCKY9-1.1.1.10

Ensure usb-storage kernel module is not available

中级别 1自动化linux

说明

USB storage provides a means to transfer and store files ensuring persistence and availability of the files independent of network connection status. Its popularity and utility has led to USB-based malware being a simple and common means for network infiltration and a first step to establishing a persistent threat within a networked environment.

检查方式

审计方法: Shell 命令

shell

m=usb-storage; found=$(find /lib/modules/$(uname -r)/kernel /usr/lib/modules/$(uname -r)/kernel -path "*/usb/storage*" 2>/dev/null | head -n1); if [ -z "$found" ]; then echo compliant; exit 0; fi; lsmod | awk '{print $1}' | grep -Fxq -- "${m//-/_}" && { echo "$m is loaded"; exit 0; }; cfg=$(modprobe --showconfig 2>/dev/null); printf '%s\n' "$cfg" | grep -Pq -- "^\h*blacklist\h+${m//-/_}\b" || { echo "$m is not blacklisted"; exit 0; }; printf '%s\n' "$cfg" | grep -Pq -- "^\h*install\h+${m//-/_}\h+(/usr)?/bin/(true|false)\b" || { echo "$m install is not disabled"; exit 0; }; echo compliant

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

Unload and disable the usb-storage kernel module. 1. Run the following commands to unload the usb-storage kernel module: # modprobe -r usb-storage 2>/dev/null # rmmod usb-storage 2>/dev/null 2. Perform the following to disable the usb-storage kernel module: Create a file ending in .conf with install usb_storage /bin/false in the /etc/modprobe.d/ directory Example: # printf '%s\n' "" "install usb_storage /bin/false" >> /etc/modprobe.d/60- usb-storage.conf Create a file ending in .conf with blacklist usb_storage in the /etc/modprobe.d/ directory Example: # printf '%s\n' "" "blacklist usb_storage" >> /etc/modprobe.d/60-usb- storage.conf

属性

操作系统: rocky-9
标签: cis-convertedkernellinuxmodules
参考: CIS Rocky Linux 9 Benchmark v3.0.0 - 1.1.1.10

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target linux