mediumnetworkverified ✓

Ensure wireless interfaces are disabled

wireless-disabled · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl

Description

Wireless networking interfaces should be disabled unless specifically required. This prevents unauthorized network connections via WiFi.

Rationale

Wireless interfaces can be exploited to establish unauthorized network connections, potentially bypassing network security controls and enabling unauthorized access to the system.

Check → Remediate

Checkcommand

# CIS: wireless interfaces must not be AVAILABLE. No wireless interface
# present == compliant (a radio toggle being "enabled" with no hardware
# is not a finding). If an interface exists, the radio must be disabled.
if [ -z "$(find /sys/class/net/*/wireless -maxdepth 0 2>/dev/null)" ]; then
  echo "OK: no wireless interfaces present"
  exit 0
fi
if [ "$(nmcli radio wifi 2>/dev/null)" = "disabled" ]; then
  echo "OK: wireless interface present but radio disabled"
  exit 0
fi
echo "FAIL: a wireless interface is present and its radio is enabled"
exit 1

expected_exit:: 0

Remediatecommand_exec

nmcli radio all off

unless:: [ -z "$(find /sys/class/net/*/wireless -maxdepth 0 2>/dev/null)" ] || nmcli radio wifi 2>/dev/null | grep -q disabled

Framework references

CIS

rhel9 3.1.2rhel8 3.1.2rhel10 3.1.2

STIG

V-258040 / RHEL-09-291040V-230506V-270755 / UBTU-24-600230V-260541 / UBTU-22-291015

NIST 800-53

CM-7SC-8

Live verification

rhel8:checkrhel9:checkubuntu22:checkubuntu24:check

#wireless#wifi#network#security