File system automounter must be disabled unless required.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-75533	UBTU-16-010590	SV-90213r2_rule		Medium

Description
Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity. Satisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227

STIG	Date
Canonical Ubuntu 16.04 LTS Security Technical Implementation Guide	2018-07-18

Details

Check Text ( C-75237r2_chk )
Verify the Ubuntu operating system disables the ability to automount devices. Check to see if automounter service is active with the following command: # systemctl status autofs autofs.service - LSB: Automounts filesystems on demand Loaded: loaded (/etc/init.d/autofs; bad; vendor preset: enabled) Active: active (running) since Thu 2017-05-04 07:53:51 EDT; 6 days ago Docs: man:systemd-sysv-generator(8) CGroup: /system.slice/autofs.service +-24206 /usr/sbin/automount --pid-file /var/run/autofs.pid If the "autofs" status is set to "active" and is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.

Check Text ( C-75237r2_chk )

Verify the Ubuntu operating system disables the ability to automount devices.

Check to see if automounter service is active with the following command:

# systemctl status autofs
autofs.service - LSB: Automounts filesystems on demand
Loaded: loaded (/etc/init.d/autofs; bad; vendor preset: enabled)
Active: active (running) since Thu 2017-05-04 07:53:51 EDT; 6 days ago
Docs: man:systemd-sysv-generator(8)
CGroup: /system.slice/autofs.service
+-24206 /usr/sbin/automount --pid-file /var/run/autofs.pid

If the "autofs" status is set to "active" and is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.

Fix Text (F-82161r2_fix)
Configure the Ubuntu operating system to disable the ability to automount devices. Turn off the automount service with the following command: # sudo systemctl stop autofs If "autofs" is required for Network File System (NFS), it must be documented with the Information System Security Officer (ISSO).