cis-ubuntu1804-v220-3-1-2

name	cis-ubuntu1804-v220-3-1-2
description	Ensure wireless interfaces are disabled
category	cis-networking
version	2.2.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-18.04","networking","wireless"]
cis_id	3.1.2
cis_benchmark	CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 - Control 3.1.2

Description

Wireless networking is used when wired networks are unavailable.

Rationale

If wireless is not to be used, wireless devices can be disabled to reduce the potential attack surface.

Impact

Many if not all laptop workstations and some desktop workstations will connect via wireless requiring wireless interfaces be enabled.

Audit Procedure

Command Line

Run the following script to verify wireless interfaces are disabled:

#!/usr/bin/bash
{
  if command -v nmcli >/dev/null 2>&1 ; then
    if nmcli radio all | grep -Eq '\s*\S+\s+disabled\s+\S+\s+disabled\b'; then
      echo "Wireless is not enabled"
    else
      nmcli radio all
    fi
  elif [ -n "$(find /sys/class/net/*/ -type d -name wireless)" ]; then
    t=0
    mession=$(for dession in $(find /sys/class/net/*/ -type d -name wireless | xargs -I{} dirname {}); do
      basename "$dession"
    done)
    for l_wireless in $mession; do
      echo "Wireless interface \"$l_wireless\" is active"
      t=1
    done
  else
    echo "Wireless is not enabled"
  fi
}

Expected Result

Wireless is not enabled

Remediation