# Ensure usb-storage kernel module is not available

Necessity: Disabling the usb-storage kernel module is a critical security measure to prevent unauthorized data transfer and the introduction of malware. USB storage devices are a common vector for both data exfiltration by insiders and the introduction of malicious code from external sources. By preventing the kernel from loading the driver for these devices, the system's attack surface is significantly reduced, which is especially important for servers and systems in physically insecure locations. Misconfiguration leaves a direct physical channel open for compromising the system's confidentiality and integrity.

Auditing and Remediation: The audit script inspects the kernel module configuration files, typically located in '/etc/modprobe.d/', to verify that an explicit rule exists to prevent the 'usb-storage' module from being loaded. The remediation script creates such a rule by instructing the system to execute a benign command ('/bin/true') instead of loading the actual module. This effectively blocks the functionality while satisfying any system dependencies that might call for the module.

Recommended State Rationale: Basic, Moderate, and Strict: The recommended state for all levels is 'Disabled'. For most server environments, USB storage is not a required function for normal operation. The risk associated with allowing USB storage devices far outweighs any potential operational benefit. Because this control provides a fundamental layer of physical and data security, there is no less-secure 'Basic' or 'Moderate' state that is advisable. Disabling the module is considered a baseline best practice (as recommended by CIS Benchmarks and other security hardening guides) for any production system where its use is not explicitly and continuously required.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'usb-storage' kernel module is disabled. The script should query the modprobe configuration for the 'usb-storage' module. If the output indicates the module is set to 'install /bin/true' or a similar non-loading command, it should return 'Disabled'. Otherwise, it should return 'Enabled'. The script's output must be limited to only the resulting string value.

## Remediation Script Working

Bash script that accepts a single positional argument, which will be the desired state (e.g., 'Disabled'). If the argument is 'Disabled', the script must create a configuration file in '/etc/modprobe.d/' containing 'install usb-storage /bin/true'. It should then attempt to unload the module using 'rmmod usb-storage' if it is currently loaded. The script must return 'true' upon successful application of the configuration or if the configuration is already compliant, and 'false' on failure.

