Disable the Automounter
Disables and stops the autofs automounter so filesystems are only mounted explicitly via /etc/fstab.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The autofs automounter mounts filesystems on demand, including removable and network media. This makes it trivial to introduce unknown or untrusted devices, a vector for malware delivery and data exfiltration. Disabling it lets the administrator control mounts statically and explicitly through /etc/fstab, reducing attack surface. Where automount is genuinely required (e.g. NFS home directories), this rule is a deliberate exception rather than a default.
What Pavois checks
Pavois queries systemd for the effective state of autofs.service (systemctl is-enabled / is-active), so it catches the unit being active or set to start at boot regardless of any auto.master map on disk. A config-file scan of /etc/auto.master could not tell whether the daemon is actually running and servicing automounts right now.
describe service('autofs.service') do
it { should_not be_enabled }
it { should_not be_running }
endHow to verify it is applied
Confirm the unit is off:
systemctl is-enabled autofs.service
systemctl is-active autofs.service
Expect disabled (or masked) and inactive. Confirm no automount mountpoints remain with findmnt -t autofs, which should return nothing.
Inspect & investigate
Inspect the unit with systemctl status autofs.service and journalctl -u autofs.service. List any current automount points with findmnt -t autofs. Package presence: dpkg -s autofs (Debian/Ubuntu) or rpm -q autofs (RHEL family).
Remediation
Pavois's harden plan acts on the service resource named autofs: it runs disable (no start at boot) then stop (not running now). Applied with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | disable, stop |
|---|---|
| name | autofs |
| resource | service |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Misconfiguration risk: an enabled automounter widens attack surface and can mount untrusted media silently. Precautions: if the host genuinely depends on autofs, for example NFS-mounted home directories or shared data, disabling it will make those paths unavailable, potentially breaking logins or applications. Confirm with findmnt -t autofs and review /etc/auto.master before applying; migrate any needed mounts to static /etc/fstab entries first to avoid disrupting users.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.1 | direct | per OS, see the benchmark table | high |
| NIST | 3.4.6, CM-6(a), CM-7(a), CM-7(b), MP-7 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.