Enable the USBGuard Service
An XCCDF Rule
Description
The USBGuard service should be enabled.
The usbguard service can be enabled with the following command:
$ sudo systemctl enable usbguard.service
Rationale
The usbguard service must be running in order to
enforce the USB device authorization policy for all USB devices.
- ID
- xccdf_org.ssgproject.content_rule_service_usbguard_enabled
- Severity
- Medium
- References
- Updated
Remediation - Puppet
include enable_usbguard
class enable_usbguard {
service {'usbguard':
enable => true,
ensure => 'running',
Remediation - Ansible
- name: Gather the package facts
package_facts:
manager: auto
tags:
- NIST-800-53-CM-8(3)(a)
- NIST-800-53-IA-3
Remediation - script:kickstart
service enable usbguard
Remediation - OS Build Blueprint
[customizations.services]
enabled = ["usbguard"]
Remediation - Kubernetes Patch
---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
annotations:
complianceascode.io/depends-on: xccdf_org.ssgproject.content_rule_package_usbguard_installed
Remediation - Shell Script
# Remediation is applicable only in certain platforms
if ( ! grep -q s390x /proc/sys/kernel/osrelease && rpm --quiet -q kernel ); then
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'usbguard.service'
"$SYSTEMCTL_EXEC" start 'usbguard.service'