back to labs
CIS: Disable Unused Filesystem Modules
MediumLinux Security15-20 minThe brief
The CIS Benchmark calls for disabling filesystem kernel modules the system doesn't need, shrinking the attack surface. Configure modprobe so cramfs, freevxfs, udf, and usb-storage cannot load: give each an install <mod> /bin/false (or /bin/true) directive in a .conf file under /etc/modprobe.d/ (modprobe ignores files that don't end in .conf). Grading reads the modprobe configuration the way a CIS-CAT scan would.
What you'll do
- cramfs cannot load (install cramfs /bin/false)
- freevxfs cannot load
- udf cannot load
- usb-storage cannot load
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.