Disable Modprobe Loading of USB Storage Driver
Ensures the usb_storage kernel module is not loaded and is blacklisted so USB mass-storage devices cannot be mounted.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
USB storage devices such as thumb drives can be used to introduce malicious software or to exfiltrate data, bypassing network controls entirely. Blacklisting the usb_storage module prevents the system from mounting USB mass-storage media, closing a major physical attack vector for data theft and malware delivery.
What Pavois checks
Pavois queries the effective module state, not config files: it verifies usb_storage is absent from the running kernel and that modprobe refuses to load it. A file-only scan would pass even if the module had already auto-loaded the moment a USB drive was plugged in; inspecting the live kernel catches an active module and any drop-in that re-enables it.
describe kernel_module('usb_storage') do
it { should_not be_loaded }
it { should be_disabled }
endHow to verify it is applied
lsmod | grep usb_storageshould return nothing.modprobe -n -v usb_storageshould printinstall /bin/true.grep -r usb_storage /etc/modprobe.d/should showblacklist usb_storageandinstall usb_storage /bin/true.- Plugging a USB drive should NOT create a new block device (
lsblkunchanged).
Inspect & investigate
dmesg | grep -i usb-storageandjournalctl -k | grep usb_storageshow attempted loads when media is inserted.lsmodandmodprobe -n -v usb_storagereflect the live state.
Remediation
Pavois's harden plan uses the kernel_module resource to blacklist usb_storage: it writes a modprobe drop-in blacklisting the module and redirecting its load to /bin/true, then unloads it if active. A reboot is required to fully clear an in-use module. Apply with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | blacklist |
|---|---|
| name | usb_storage |
| reboot_required | true |
| resource | kernel_module |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Disables ALL USB mass storage, external drives, USB keys, USB card readers will no longer mount. Caution: do not apply to workstations or hosts that depend on USB media for backups, installs or data transfer, and ensure you are not booting/recovering from USB. USB keyboards/mice are unaffected (different driver). Verify operational needs with lsblk and findmnt before applying.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.1.1.9, 3.4.2, 1.1.1.8, 1.1.1.10 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.21, CM-6(a), CM-7(a), CM-7(b), MP-7 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 3.4.2 | supporting | 4.0.1 | medium |
| DISA STIG | UBTU-22-291010, UBTU-24-300039 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.