Description
The autofs daemon mounts and unmounts filesystems, such as user
home directories shared via NFS, on demand. In addition, autofs can be used to handle
removable media, and the default configuration provides the cdrom device as /misc/cd.
However, this method of providing access to removable media is not common, so autofs
can almost always be disabled if NFS is not in use. Even if NFS is required, it may be
possible to configure filesystem mounts statically by editing /etc/fstab
rather than relying on the automounter.
The autofs service can be disabled with the following command:
$ sudo systemctl mask --now autofs.service
Rationale
Disabling the automounter permits the administrator to
statically control filesystem mounting through /etc/fstab.
Additionally, automatically mounting filesystems permits easy introduction of
unknown devices, thereby facilitating malicious activity.
Shell script
The following script can be run on the host to remediate the issue.
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
SYSTEMCTL\_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL\_EXEC" stop 'autofs.service'
"$SYSTEMCTL\_EXEC" disable 'autofs.service'
"$SYSTEMCTL\_EXEC" mask 'autofs.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL\_EXEC" -q list-unit-files autofs.socket; then
"$SYSTEMCTL\_EXEC" stop 'autofs.socket'
"$SYSTEMCTL\_EXEC" mask 'autofs.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL\_EXEC" reset-failed 'autofs.service' || true
else
>&2 echo 'Remediation is not applicable, nothing was done'
fi
Ansible playbook
The following playbook can be run with Ansible to remediate the issue.
- name: Block Disable service autofs
block:
- name: Disable service autofs
block:
- name: Disable service autofs
systemd:
name: autofs.service
enabled: 'no'
state: stopped
masked: 'yes'
rescue:
- name: Intentionally ignored previous 'Disable service autofs' failure, service
was already disabled
meta: noop
when: ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
tags:
- NIST-800-171-3.4.6
- NIST-800-53-CM-6(a)
- NIST-800-53-CM-7(a)
- NIST-800-53-CM-7(b)
- NIST-800-53-MP-7
- disable\_strategy
- low\_complexity
- low\_disruption
- medium\_severity
- no\_reboot\_needed
- service\_autofs\_disabled
- name: Unit Socket Exists - autofs.socket
command: systemctl list-unit-files autofs.socket
register: socket\_file\_exists
changed\_when: false
failed\_when: socket\_file\_exists.rc not in [0, 1]
check\_mode: false
when: ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
tags:
- NIST-800-171-3.4.6
- NIST-800-53-CM-6(a)
- NIST-800-53-CM-7(a)
- NIST-800-53-CM-7(b)
- NIST-800-53-MP-7
- disable\_strategy
- low\_complexity
- low\_disruption
- medium\_severity
- no\_reboot\_needed
- service\_autofs\_disabled
- name: Disable socket autofs
systemd:
name: autofs.socket
enabled: 'no'
state: stopped
masked: 'yes'
when:
- ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
- '"autofs.socket" in socket\_file\_exists.stdout\_lines[1]'
tags:
- NIST-800-171-3.4.6
- NIST-800-53-CM-6(a)
- NIST-800-53-CM-7(a)
- NIST-800-53-CM-7(b)
- NIST-800-53-MP-7
- disable\_strategy
- low\_complexity
- low\_disruption
- medium\_severity
- no\_reboot\_needed
- service\_autofs\_disabled
