3.1.2 Ensure wireless interfaces are disabled

Information

Wireless networking is used when wired networks are unavailable.

Rationale:

If wireless is not to be used, wireless devices should be disabled to reduce the potential attack surface.

Impact:

Many if not all laptop workstations and some desktop workstations will connect via wireless requiring these interfaces be enabled.

Solution

Run the following script to disable any wireless interfaces:

#!/bin/bash

if command -v nmcli >/dev/null 2>&1 ; then
nmcli radio all off
else
if [ -n '$(find /sys/class/net/*/ -type d -name wireless)' ]; then
mname=$(for driverdir in $(find /sys/class/net/*/ -type d -name wireless | xargs -0 dirname); do basename '$(readlink -f '$driverdir'/device/driver/module)';done | sort -u)
for dm in $mname; do
echo 'install $dm /bin/true' >> /etc/modprobe.d/disable_wireless.conf
done
fi
fi

See Also

https://workbench.cisecurity.org/files/3636

Item Details

Category: ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-18(1), 800-53|SC-8, CCI|CCI-001443, CCI|CCI-001444, CCI|CCI-002418, CSCv7|15.4, CSCv7|15.5, Rule-ID|SV-204634r603261_rule, STIG-ID|RHEL-07-041010

Plugin: Unix

Control ID: 110dc6456c161f56a08f2b90d39dcb8f0d2b4ae65479fdfa367beb06ccc4b428