documentation_complete: true


title: 'Disable the Automounter'

description: |-
    The <tt>autofs</tt> daemon mounts and unmounts filesystems, such as user
    home directories shared via NFS, on demand. In addition, autofs can be used to handle
    removable media, and the default configuration provides the cdrom device as <tt>/misc/cd</tt>.
    However, this method of providing access to removable media is not common, so autofs
    can almost always be disabled if NFS is not in use. Even if NFS is required, it may be
    possible to configure filesystem mounts statically by editing <tt>/etc/fstab</tt>
    rather than relying on the automounter.
    <br /><br />
    {{{ describe_service_disable(service="autofs") }}}

rationale: |-
    Disabling the automounter permits the administrator to
    statically control filesystem mounting through <tt>/etc/fstab</tt>.
    <br /><br />
    Additionally, automatically mounting filesystems permits easy introduction of
    unknown devices, thereby facilitating malicious activity.

severity: medium

identifiers:
    cce@rhcos4: CCE-82663-6
    cce@rhel8: CCE-80873-3
    cce@rhel9: CCE-83850-8
    cce@rhel10: CCE-88947-7
    cce@sle12: CCE-83070-3
    cce@sle15: CCE-83278-2
    cce@sle16: CCE-96156-5
    cce@slmicro5: CCE-93772-2

references:
    cis-csc: 1,12,15,16,5
    cis@sle12: 1.1.23
    cis@sle15: 1.1.23
    cobit5: APO13.01,DSS01.04,DSS05.03,DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.03,DSS06.10
    cui: 3.4.6
    hipaa: 164.308(a)(3)(i),164.308(a)(3)(ii)(A),164.310(d)(1),164.310(d)(2),164.312(a)(1),164.312(a)(2)(iv),164.312(b)
    isa-62443-2009: 4.3.3.2.2,4.3.3.5.1,4.3.3.5.2,4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9,4.3.3.7.2,4.3.3.7.4
    isa-62443-2013: 'SR 1.1,SR 1.10,SR 1.13,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.7,SR 1.8,SR 1.9,SR 2.1,SR 2.6'
    iso27001-2013: A.11.2.6,A.13.1.1,A.13.2.1,A.18.1.4,A.6.2.1,A.6.2.2,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3
    nist: CM-7(a),CM-7(b),CM-6(a),MP-7
    nist-csf: PR.AC-1,PR.AC-3,PR.AC-6,PR.AC-7
    srg: SRG-OS-000114-GPOS-00059,SRG-OS-000378-GPOS-00163,SRG-OS-000480-GPOS-00227
    stigid@ol7: OL07-00-020110
    stigid@ol8: OL08-00-040070
    stigid@sle12: SLES-12-010590
    stigid@sle15: SLES-15-010240

ocil_clause: |-
    {{{ ocil_clause_service_disabled(service="autofs") }}}

ocil: |-
    {{{ ocil_service_disabled(service="autofs") }}}

platform: system_with_kernel and package[autofs]

template:
    name: service_disabled
    vars:
        servicename: autofs

fixtext: |-
    Configure {{{ full_name }}} to disable the ability to automount devices.
    {{{ describe_service_disable(service="autofs") }}}

srg_requirement:
    {{{ full_name }}} file system automounter must be disabled unless required.
