cis-ubuntu1804-v220-1-1-10

name	cis-ubuntu1804-v220-1-1-10
description	Disable USB Storage
category	cis-storage
version	2.2.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-18.04","usb","usb-storage","kernel-module"]
cis_id	1.1.10
cis_benchmark	CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Disable USB Storage

Profile

Level 1 - Server / Level 2 - Workstation, Assessment: Automated

Description

USB storage provides a means to transfer and store files insuring persistence and availability of the files independent of network connection status. Its popularity and utility has led to USB-based malware being a simple and common means for network infiltration and a first step to establishing a persistent threat within a networked environment.

Rationale

Restricting USB access on the system will decrease the physical attack surface for a device and diminish the possible vectors to introduce malware.

Impact

An alternative snolution to disabling the usb-storage module may be found in USBGuard.

Use of USB storage devices to transfer work files may be disrupted.

Audit Procedure

Command Line

Run the following script to verify the usb-storage module is disabled. If the module is available in the running kernel:

• An entry including /bin/true or /bin/false exists in a file within the /etc/modprobe.d/ directory
• The module is deny listed in a file within the /etc/modprobe.d/ directory
• The module is not loaded in the kernel

#!/usr/bin/env bash
{
    l_output="" l_output2="" l_output3="" l_dl=""
    l_mname="usb-storage"
    l_mtype="drivers"
    l_searchloc="/lib/modprobe.d/*.conf /usr/local/lib/modprobe.d/*.conf /run/modprobe.d/*.conf /etc/modprobe.d/*.conf"
    l_mpath="/lib/modules/**/kernel/$l_mtype"
    l_mpname="$(tr '-' ' ' <<< "$l_mname")"
    l_mndir="$(tr '-' '/' <<< "$l_mname")"
    module_loadable_chk()
    {
        l_loadable="$(modprobe -n -v "$l_mname")"
        [  -gt  ] && l_loadable=
         grep -Pq --  <<< ; 
            l_output=
        
            l_output2=
        
    }
    ()
    {
         ! lsmod | grep  > /dev/null 2>&1; 
            l_output=
        
            l_output2=
        
    }
    ()
    {
        l_dl=
         modprobe --showconfig | grep -Pq -- ; 
            l_output=
        
            l_output2=
        
    }
     l_mdir  ; 
         [ -d  ] && [ -n  ]; 
            l_output3=
            [  !=  ] && module_deny_chk
             [  =  ]; 
                module_loadable_chk
                module_loaded_chk
            
        
            l_output=
        
    
    [ -n  ] &&  -e 
     [ -z  ]; 
         -e 
    
         -e 
        [ -n  ] &&  -e 
    
}