# Ensure autofs services are not in use

The 'autofs' service automatically mounts filesystems, such as network shares or removable media, on demand. While convenient, it increases the system's attack surface. Unnecessary services can introduce vulnerabilities, and a misconfigured automounter could be exploited to mount malicious resources or gain unauthorized access to data. Disabling or removing 'autofs' adheres to the security principle of least functionality, ensuring that only essential services are running. The audit script verifies the current status of the 'autofs' package and service. The remediation script provides a method to either disable the service or completely remove the package to align with security best practices. The Basic recommendation is to disable the service, which is a quick measure to prevent it from running. The Moderate and Strict recommendations, considered best practice by standards like the CIS Benchmarks, advocate for completely uninstalling the package to eliminate any risk associated with its presence on the system.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the status of the 'autofs' service. The script should determine if the package is installed and if the service is enabled. It must return 'Not Installed' if the package is not present, 'Disabled' if the package is installed but the service is not enabled, or 'Enabled' if the service is enabled. The script must only output the determined state string, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts one positional argument: the desired state, which can be 'Not Installed' or 'Disabled'. If the argument is 'Not Installed', the script should use the system's package manager to purge the 'autofs' package. If the argument is 'Disabled', it should stop and disable the 'autofs' service using systemctl. The script must return 'true' upon successful completion or 'false' if an error occurs.

