{
  "id": "CB-UBU-NET-003",
  "standard": "ubuntu",
  "version": "0.1.1",
  "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.1/CB-UBU-NET-003",
  "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.1/CB-UBU-NET-003.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.1/CB-UBU-NET-003.yml",
  "profiles_effective": [
    "server",
    "server-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-NET-003",
    "title": "Disable wireless network interfaces on servers",
    "finding": {
      "title": "A wireless network interface is available on a server",
      "description": "A wireless interface can connect the server to a network outside the firewall and monitoring of the data center."
    },
    "status": "active",
    "profiles": [
      "server"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "automated",
    "tags": [
      "wireless",
      "network",
      "hardware"
    ],
    "description": "Servers are connected by cable to known networks. A Wi-Fi interface, often present on the\nmainboard or added by a USB adapter, shows up under `/sys/class/net/` with a `wireless`\ndirectory or a `phy80211` link once its driver is loaded. This control checks that no such\ninterface exists, which means the driver of any Wi-Fi hardware is not loaded.\n",
    "rationale": "A wireless interface lets someone near the building reach the server, or lets the server reach\nan uncontrolled network, bypassing the network firewall and its logs. Not loading the driver\nremoves the interface and the driver code from the attack surface.\n",
    "impact": "Wi-Fi stops working. Do not apply it to a server whose only network link is wireless.\n",
    "audit": {
      "manual": "Run `ls -d /sys/class/net/*/wireless /sys/class/net/*/phy80211 2>/dev/null`. It must print\nnothing. `iw dev`, when installed, must not list any interface.\n",
      "checks": [
        {
          "id": "interfaces",
          "engine": "shell",
          "description": "Network interfaces with a wireless extension.",
          "spec": {
            "script": "found=\nfor d in /sys/class/net/*; do\n  if [ -e \"$d/wireless\" ] || [ -e \"$d/phy80211\" ]; then found=\"$found ${d##*/}\"; fi\ndone\nif [ -n \"$found\" ]; then echo \"wireless interfaces:$found\"; exit 1; fi\necho 'no wireless interface'\n"
          }
        }
      ]
    },
    "remediation": {
      "manual": "1. Find the driver of each wireless interface:\n   `basename \"$(readlink -f /sys/class/net/<interface>/device/driver/module)\"`.\n2. Create `/etc/modprobe.d/60-cirsec-wireless.conf` with, for each driver,\n   `install <driver> /bin/false` and `blacklist <driver>`.\n3. Bring the interface down (`ip link set <interface> down`) and reboot.\nDisabling the device in the firmware setup, or removing it, is better when possible.\n",
      "rollback": "Delete `/etc/modprobe.d/60-cirsec-wireless.conf` and reboot.\n"
    },
    "references": [
      {
        "title": "iw(8), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man8/iw.8.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "modprobe.d(5), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man5/modprobe.d.5.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-18",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1011"
      },
      {
        "framework": "cwe",
        "id": "CWE-1188"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic, BIOS boot",
        "notes": "No wireless interface on the lab VM, check passes; remediation is manual."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic, BIOS boot",
        "notes": "No wireless interface on the lab VM, check passes; remediation is manual."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic, BIOS boot",
        "notes": "No wireless interface on the lab VM, check passes; remediation is manual."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic, BIOS boot",
        "notes": "No wireless interface on the lab VM, check passes; remediation is manual."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}