Profile Applicability:
 • Level 1

Description:
 The autofs service automatically mounts filesystems on demand. If not required, it should be disabled to reduce the system attack surface and prevent unintended mounts that may introduce security risks.

Rationale:
 Disabling unused autofs services minimizes unnecessary system complexity and potential vulnerabilities arising from automatic mounts.

Impact:
 Pros:

  • Reduces attack surface by disabling unused services.

  • Prevents unexpected or unauthorized filesystem mounts.

Cons:

  • May disrupt workflows relying on automatic mounting if misconfigured.

Default Value:
 autofs service may be enabled or running by default on some systems.

Pre-requisites:

  • Root or sudo privileges to manage system services.

Remediation:

Test Plan:

Using Linux command line:

1. Check if autofs service is enabled:

systemctl is-enabled autofs

2. Check if autofs service is running:

systemctl status autofs


Implementation Plan:

Using Linux command line:

1. Disable the autofs service:

systemctl disable autofs

2. Stop the running autofs service:

systemctl stop autofs

3. Verify service is disabled and stopped:

systemctl is-enabled autofs  
systemctl status autofs

Backout Plan:

Using Linux command line:

1. Enable and start autofs service if needed:

systemctl enable autofs  
systemctl start autofs

2. Verify service status.

References:

  • CIS Amazon Linux 2 Benchmark v3.0.0

  • Systemd Service Management