1.1.1.8 Ensure mounting of FAT filesystems is disabled - /etc/modprobe.d/*

Information

The FAT filesystem format is primarily used on older windows systems and portable USB drives or flash modules. It comes in three types FAT12 , FAT16 , and FAT32 all of which are supported by the vfat kernel module.

Rationale:

Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.

Impact:

FAT filesystems are often used on portable USB sticks and other flash media are commonly used to transfer files between workstations, removing VFAT support may prevent the ability to transfer files in this way.

Disabling the vfat module can prevent boot on UEFI systems.

Solution

Edit or create the file /etc/modprobe.d/CIS.conf and add the following line:

install vfat /bin/true

Run the following command to unload the vfat module:

# rmmod vfat

See Also

https://workbench.cisecurity.org/files/3738

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7b.

Plugin: Unix

Control ID: 7651971489d7f5a9ee68fcb47474be829a5f7ad30602c3f56f2ac69c9ea388a0