SV-37983r1: The system must have IEEE 1394 (Firewire) disabled unless needed. | Red Hat Enterprise Linux 5 Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

The system must have IEEE 1394 (Firewire) disabled unless needed.

Description

Discussion Text

Firewire is a common computer peripheral interface. Firewire devices may include storage devices with the potential to install malicious software on a system or exfiltrate data.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366

Additional Details

Responsibility

System Administrator

IA Controls

ECSC-1

References

DPMS Target Red Hat 5 DISA DPMS Target Red Hat 5 2154

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.fso.rhel11:def:440
# The system must have IEEE 1394 (Firewire) disabled unless needed.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# check IEEE 1394 (Firewire) is disabled /etc/modprobe.conf
# textfilecontent54_object (textfilecontent54_test)
test_1() {
  grep -Pq '^install[ 	]ieee1394[ 	]/bin/true$' '/etc/modprobe.conf' &>/dev/null
}
# check IEEE 1394 (Firewire) is disabled /etc/modprobe.d/*
# textfilecontent54_object (textfilecontent54_test)
test_2() {
  grep -rqP --include='*' '^install[ 	]ieee1394[ 	]/bin/true$' '/etc/modprobe.d' &>/dev/null
}

if ( test_1 || test_2 ); then
  echo "PASS"
else
  echo "FAIL"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.fso.rhel11:def:440
if [ ! -f "/etc/modprobe.conf" ] || ! grep -q "^install[ \t]ieee1394[ \t]/bin/true$" /etc/modprobe.conf; then
  if [ ! -d "/etc/modprobe.d" ] || ! find /etc/modprobe.d -type f -name "*.conf" -exec grep -q "^install[ \t]ieee1394[ \t]/bin/true$" {} \; ; then
    echo "PASS"
    exit 0
  fi
fi
echo "FAIL"
exit 1

Remediation

Prevent the system from loading the firewire module.
# echo 'install ieee1394 /bin/true' >> /etc/modprobe.conf