Disable the autofs automounter

Description

autofs mounts file systems (local devices, NFS or SMB shares) when a path under its maps is accessed, and unmounts them when idle.

The control passes when autofs.service is masked or not installed at all.

The control is in the server profile and in the hardened desktop profile: on standard desktops, on-demand mounts are an expected feature.

Rationale

Automatic mounting of removable media lets anyone with physical access bring in files or malicious file system images; automatic network mounts reach shares that the administrator may not expect.

Impact

File systems listed in the autofs maps are no longer mounted on demand: mount them through /etc/fstab instead. Systems that rely on autofs, such as home directories on NFS, must exclude this control in their tailoring file.

Audit

Run systemctl is-enabled autofs.service. It must print masked, or fail because the unit does not exist.

Automated: every check must pass. Scanners report each check by its id.

autofs

autofs automounter.

unit: autofs.service
state: masked

Remediation

Run systemctl mask --now autofs.service, or apt purge autofs if the package is not needed.

Rollback

Run systemctl unmask autofs.service then systemctl enable --now autofs.service.

autofs

Generated from check autofs: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• autofs(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R62) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle