STIGQter: STIG Summary: Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The Ubuntu operating system must disable automatic mounting of Universal Serial Bus (USB) mass storage driver.

DISA Rule

SV-219339r610963_rule

Vulnerability Number

V-219339

Group Title

SRG-OS-000378-GPOS-00163

Rule Version

UBTU-18-010509

Severity

CAT II

CCI(s)

• CCI-001958 - The information system authenticates an organization-defined list of specific and/or types of devices before establishing a local, remote, or network connection.

Weight

10

Fix Recommendation

Configure the Ubuntu operating system to disable using the USB storage kernel module.

Create a file under "/etc/modprobe.d" to contain the following:

# sudo su -c "echo install usb-storage /bin/true >> /etc/modprobe.d/DISASTIG.conf"

Configure the operating system to disable the ability to use USB mass storage devices.

# sudo su -c "echo blacklist usb-storage >> /etc/modprobe.d/DISASTIG.conf"

Check Contents

Verify that Ubuntu operating system disables ability to load the USB storage kernel module.

# grep usb-storage /etc/modprobe.d/* | grep "/bin/true"

install usb-storage /bin/true

If the command does not return any output, or the line is commented out, this is a finding.

Verify the operating system disables the ability to use USB mass storage device.

# grep usb-storage /etc/modprobe.d/* | grep -i "blacklist"

blacklist usb-storage

If the command does not return any output, or the line is commented out, this is a finding.

Vulnerability Number

V-219339

Documentable

False

Rule Version

UBTU-18-010509

Severity Override Guidance

Verify that Ubuntu operating system disables ability to load the USB storage kernel module.

# grep usb-storage /etc/modprobe.d/* | grep "/bin/true"

install usb-storage /bin/true

If the command does not return any output, or the line is commented out, this is a finding.

Verify the operating system disables the ability to use USB mass storage device.

# grep usb-storage /etc/modprobe.d/* | grep -i "blacklist"

blacklist usb-storage

If the command does not return any output, or the line is commented out, this is a finding.

Check Content Reference

M

Target Key

4055

Comments