← Back to Rancher Government Solutions (RGS) Harvester Government GPOS Security Technical Implementation Guide

V-285678

CAT II (Medium)

The operating system must authenticate peripherals before establishing a connection.

Rule ID

SV-285678r1272871_rule

STIG

Rancher Government Solutions (RGS) Harvester Government GPOS Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-001958

Discussion

Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. Peripherals include, but are not limited to, such devices as flash drives, external storage, and printers.

Check Content

Verify Harvester Government does not automount USB mass storage devices when connected to the host with the following command:

grep usb-storage /etc/modprobe.d/50-blacklist.conf

blacklist usb-storage

If the line is commented out, or the line is missing, this is a finding.

Fix Text

Configure the Harvester Government OS to prevent the automatic loading of USB mass storage drivers by ensuring the "usb-storage" kernel module is blacklisted.

1. Access the node terminal with appropriate privileges.

2. Create the blacklist file if it does not exist:

touch /etc/modprobe.d/50-blacklist.conf

3. Add or update the following line in the file:

blacklist usb-storage

(Note: echo "blacklist usb-storage" >> /etc/modprobe.d/50-blacklist.conf)

4. Ensure the entry is not commented out.

5. Apply changes and restart the node to apply the configuration:

reboot