Disable the Bluetooth service

Description

On Debian, Bluetooth is handled by bluetoothd from the bluez package, run by bluetooth.service. When the package is installed, the service starts as soon as an adapter is present. This control requires the service to be masked, or bluez to be absent.

Rationale

Bluetooth stacks have had remotely exploitable flaws reachable without pairing (BlueBorne, BleedingTooth). A server never needs Bluetooth, and a hardened workstation should not expose a radio interface that can be reached from a nearby room or car park.

Impact

Bluetooth keyboards, mice, headsets and file transfer stop working.

Audit

Run systemctl is-enabled bluetooth.service. It must print masked, or fail because the unit does not exist (bluez not installed).

Automated: every check must pass. Scanners report each check by its id.

service

State of bluetooth.service.

unit: bluetooth.service
state: masked

Remediation

Run systemctl mask --now bluetooth.service, or remove the package with apt purge bluez when nothing depends on it.

Rollback

Run systemctl unmask bluetooth.service and systemctl start bluetooth.service.

mask

Generated from check service: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• Debian Wiki - Bluetooth Debian, vendor-doc, accessed 2026-10-18
• systemctl(1), Debian manual pages Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle