# Ensure autofs services are not in use

The autofs service automatically mounts filesystems, such as those on USB devices or network shares, when they are accessed. While convenient, this functionality poses a significant security risk. It can be exploited to automatically mount malicious devices or filesystems, introducing malware or facilitating unauthorized data access, thereby increasing the system's attack surface. Disabling or masking this service is critical on systems where it is not explicitly required. The audit script checks the service's current state via systemctl. The remediation script alters this state. A 'Basic' or 'Moderate' recommendation is to 'disable' the service, which prevents it from starting on boot. The 'Strict' recommendation is to 'mask' the service. Masking creates a symlink from the service file to /dev/null, making it impossible for any process or user to start the service, offering the highest level of assurance against its activation.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['disabled']` |
| **Strict** | `['masked']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the status of the 'autofs' service. The script should query 'systemctl is-enabled autofs'. If the service is not installed, it should return 'not found'. Otherwise, it must return only the current status (e.g., 'disabled', 'enabled', 'masked') without any extra text or labels.

## Remediation Script Working

Bash script that accepts one argument: 'disabled' or 'masked'. If the argument is 'disabled', the script must stop and disable the 'autofs' service using 'systemctl stop autofs' and 'systemctl disable autofs'. If the argument is 'masked', it must mask the service using 'systemctl mask autofs'. The script must return 'true' upon successful execution and 'false' on failure.

