Disable Modprobe Loading of USB Storage Driver

Classification:

compliance

Framework:

Control:

Description

To prevent USB storage devices from being used, configure the kernel module loading system to prevent automatic loading of the USB storage driver.

To configure the system to prevent the usb-storage kernel module from being loaded, add the following line to the file /etc/modprobe.d/usb-storage.conf:

install usb-storage /bin/true

This will prevent the modprobe program from loading the usb-storage module, but will not prevent an administrator (or another program) from using the insmod program to load the module manually.

Rationale

USB storage devices such as thumb drives can be used to introduce malicious software.

Remediation

Shell script

The following script can be run on the host to remediate the issue.

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if LC\_ALL=C grep -q -m 1 "^install usb-storage" /etc/modprobe.d/usb-storage.conf ; then
 
 sed -i 's#^install usb-storage.\*#install usb-storage /bin/true#g' /etc/modprobe.d/usb-storage.conf
else
 echo -e "\n# Disable per security requirements" >> /etc/modprobe.d/usb-storage.conf
 echo "install usb-storage /bin/true" >> /etc/modprobe.d/usb-storage.conf
fi

else
 >&2 echo 'Remediation is not applicable, nothing was done'
fi

Ansible playbook

The following playbook can be run with Ansible to remediate the issue.

- name: Ensure kernel module 'usb-storage' is disabled
 lineinfile:
 create: true
 dest: /etc/modprobe.d/usb-storage.conf
 regexp: install\s+usb-storage
 line: install usb-storage /bin/true
 when: ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - NIST-800-171-3.1.21
 - NIST-800-53-CM-6(a)
 - NIST-800-53-CM-7(a)
 - NIST-800-53-CM-7(b)
 - NIST-800-53-MP-7
 - disable\_strategy
 - kernel\_module\_usb-storage\_disabled
 - low\_complexity
 - medium\_disruption
 - medium\_severity
 - reboot\_required