用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-ubuntu1804-v220-1-1-9命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | cis-ubuntu1804-v220-1-1-9 |
| description | Disable Automounting |
| category | cis-storage |
| version | 2.2.0 |
| author | cyberstrike-official |
| tags | ["cis","ubuntu","linux","ubuntu-18.04","autofs","automount","service"] |
| cis_id | 1.1.9 |
| cis_benchmark | CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 |
| tech_stack | ["ubuntu","linux"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Level 1 - Server / Level 2 - Workstation, Assessment: Automated
autofs allows automatic mounting of devices, typically including CD/DVDs and USB drives.
With automounting enabled anyone with physical access could attach a USB drive or disc and have its contents available in system even if they lacked permissions to mount it themselves. autofs can be configured to mount on insertion or accessed directly.
The use of portable hard drives is very common for workstation users. If your organization allows the use of portable storage or media on workstations and physical access controls to workstations are considered adequate, the risk of autofs can be mitigated.
Run the following commands to verify autofs is not installed or the autofs service is masked:
If autofs is not installed:
# dpkg-query -W -f='${binary:Package}\t${Status}\t${db:Status-Status}\n' autofs
If autofs is installed, verify the service is masked:
# systemctl is-enabled autofs 2>/dev/null | grep 'enabled'
If autofs is not installed, dpkg-query should return:
dpkg-query: no packages found matching autofs
If autofs is installed, systemctl is-enabled autofs should NOT return enabled. Ideally the service should be masked.
Run one of the following commands:
To remove autofs:
apt purge autofs
-OR-
To disable and mask the autofs service:
systemctl stop autofs
systemctl mask autofs
autofs is not installed by default on Ubuntu 18.04.
v8 - 10.3 Disable Autorun and Autoplay for Removable Media (IG 1, IG 2, IG 3) v7 - 8.5 Configure Devices Not To Auto-run Content (IG 1, IG 2, IG 3)
MITRE ATT&CK Mappings: T1068, T1068.000, T1203, T1203.000, T1211, T1211.000, T1212, T1212.000 (TA0001, TA0008) - M1042