The Red Hat Enterprise Linux operating system must be configured to disable USB mass storage.

From Red Hat Enterprise Linux 7 Security Technical Implementation Guide

Associated with: CCI-000366 CCI-000778 CCI-001958

SV-86607r3_rule The Red Hat Enterprise Linux operating system must be configured to disable USB mass storage.

Vulnerability discussion

USB mass storage permits easy introduction of unknown devices, thereby facilitating malicious activity.Satisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227

Check content

If there is an HBSS with a Device Control Module and a Data Loss Prevention mechanism, this requirement is not applicable. Verify the operating system disables the ability to use USB mass storage devices. Check to see if USB mass storage is disabled with the following command: # grep usb-storage /etc/modprobe.d/blacklist.conf blacklist usb-storage If the command does not return any output or the output is not "blacklist usb-storage", and use of USB storage devices is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.

Fix text

Configure the operating system to disable the ability to use USB mass storage devices. # vi /etc/modprobe.d/blacklist.conf Add or update the line: blacklist usb-storage

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.