Disable ATM Support
Ensures the atm kernel module is not loaded and is blacklisted so the unused ATM protocol stack cannot be activated.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
ATM (Asynchronous Transfer Mode) is a legacy WAN protocol almost no modern server uses. Its kernel module adds parsing and socket code to the attack surface; a flaw there could be exploited by local or remote input for privilege escalation or denial of service. Disabling the unused module removes that exposure.
What Pavois checks
Pavois uses the InSpec kernel_module('atm') resource to assert the module is not currently loaded and is disabled (blacklisted / pointed to /bin/false via modprobe). This queries the live kernel and effective modprobe configuration rather than guessing from a single .conf file, so it catches a module that is blacklisted but still loaded, or a config that an override re-enables.
describe kernel_module('atm') do
it { should_not be_loaded }
it { should be_disabled }
endHow to verify it is applied
Run lsmod | grep atm (no output = not loaded) and modprobe -n -v atm (expect install /bin/true or /bin/false, indicating it cannot load). modprobe --showconfig | grep atm shows the effective blacklist/install rules.
Inspect & investigate
A blocked load attempt is logged by the kernel: check dmesg / journalctl -k | grep -i atm. The active module list is lsmod; the resolved modprobe policy is modprobe --showconfig.
Remediation
pavois harden apply uses the kernel_module resource to blacklist atm: it writes a modprobe rule (install atm /bin/false plus a blacklist entry) so the module cannot be auto-loaded, and unloads it if currently loaded. reboot_required is true, a reboot guarantees the module is no longer resident.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | blacklist |
|---|---|
| name | atm |
| reboot_required | true |
| resource | kernel_module |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
On a normal server, disabling atm has no functional impact, ATM hardware is virtually unseen. Precaution: only on the rare host using ATM/DSL WAN interfaces would blacklisting break connectivity; confirm no ATM NIC is in use (ip link, lsmod | grep atm) before applying. A reboot is needed to fully unload an already-loaded module.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 3.2.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.