Disable wireless network interfaces on servers

Description

Servers are connected by cable to known networks. A Wi-Fi interface, often present on the mainboard or added by a USB adapter, shows up under /sys/class/net/ with a wireless directory or a phy80211 link once its driver is loaded. This control checks that no such interface exists, which means the driver of any Wi-Fi hardware is not loaded.

Rationale

A wireless interface lets someone near the building reach the server, or lets the server reach an uncontrolled network, bypassing the network firewall and its logs. Not loading the driver removes the interface and the driver code from the attack surface.

Impact

Wi-Fi stops working. Do not apply it to a server whose only network link is wireless.

Audit

Run ls -d /sys/class/net/*/wireless /sys/class/net/*/phy80211 2>/dev/null. It must print nothing. iw dev, when installed, must not list any interface.

Automated: every check must pass. Scanners report each check by its id.

interfaces

Network interfaces with a wireless extension.

script: |
  found=
  for d in /sys/class/net/*; do
    if [ -e "$d/wireless" ] || [ -e "$d/phy80211" ]; then found="$found ${d##*/}"; fi
  done
  if [ -n "$found" ]; then echo "wireless interfaces:$found"; exit 1; fi
  echo 'no wireless interface'

Remediation

1. Find the driver of each wireless interface: basename "$(readlink -f /sys/class/net/<interface>/device/driver/module)".
2. Create /etc/modprobe.d/60-cirsec-wireless.conf with, for each driver, install <driver> /bin/false and blacklist <driver>.
3. Bring the interface down (ip link set <interface> down) and reboot. Disabling the device in the firmware setup, or removing it, is better when possible.

Rollback

Delete /etc/modprobe.d/60-cirsec-wireless.conf and reboot.

References

• iw(8), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• modprobe.d(5), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle