LowOS hardeningBLWK-KERNEL-021

Kernel module not blacklisted: usb-storage

What this means

The usb-storage module isn't blacklisted, so plugging in a USB mass-storage device on this host will auto-mount it. On a server — especially one in a rack you don't physically control, like a colo or a branch office — that's a data-exfiltration and BadUSB path that needs no credentials and leaves little trace: someone with thirty seconds of physical access walks away with the disk contents. This rule is scoped to the server profile on purpose. The same advice on a laptop or desktop is actively harmful — it breaks every USB stick, external drive, and SD reader the user owns, to defend against an attacker who by definition already has their hands on the machine. Split out of BLWK-KERNEL-020 for exactly that reason.

How to fix it

On a server with no legitimate need for USB storage, add install usb-storage /bin/true to a file under /etc/modprobe.d/ (e.g. /etc/modprobe.d/blacklist-usb-storage.conf) and run update-initramfs -u. Do NOT apply this to a workstation — you will break all removable media on it.

Check it yourself

Run a scan and look for BLWK-KERNEL-021 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads module_blacklist and reports this check when:

blacklisted == false and loadable == true and module == "usb-storage"

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• CIS Benchmark 1.1.1

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001