Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 0 down vote favorite

Is it possible to disable USB ports and CDRom and VGA output in the Dell R310 from CentOS or FreeBSD (without BIOS)?

A demo server is running in a customer test laboratory, where they can simply get inside by plugging in a monitor and a USB keyboard and mouse, which I do not want.

Is there any CentOS/FreeBSD way to block all the USB ports and VGA output? And only keep open the serial console port/ethernet to maintain and use?

share|improve this question
1  
What threats are you concerned with? If they pull out the disk and put it into another machine, they can do what they want. Is the disk encrypted? If so, where's the key stored? – Gilles Jun 26 '11 at 22:26
@Gilles: Disk they can copy but i use "dmidecode | grep UUID" Its only for that DELR310 embedded. – YumYumYum Jun 26 '11 at 22:40
I just do not want they put USB/Monitor to use that same DELR310 then its secured 30% which is a lot to me. – YumYumYum Jun 26 '11 at 22:41
1  
That doesn't protect anything: they can just edit out the check. – Gilles Jun 26 '11 at 22:43
@Gilles: I understand what you mean. But is there at-least any way to disable the VGA output? Where only serial port will be active, just to minimize the chances for such case. – YumYumYum Jun 26 '11 at 22:51

1 Answer

up vote 3 down vote

I don't know of a way to disable video but there's a few ways to disable USB.

  1. Edit grub.conf, append 'nousb', and reboot. (via)
  2. Blacklist usb kernel modules using instructions on the CentOS wiki. They're written for usb-storage you'd need to modify them to blacklist things like a USB keyboard.

If the server is already running, you can try removing the usb modules while its running. You could possibly disable the usual virtual terminals on alt+f1 and so on, by commenting out their lines in /etc/inittab and kill -HUP 1 so there's no 'obvious' way to log in but there's always ssh to worry about then.

With that said, like Gilles said, that's really not going to protect your system. Anyone can take the drives out of your server and copy the data from it assuming they're not encrypted.

If your goal is to stop people from messing with it, not stealing the data on the drives there's a few options since you mention you have a Dell R310. These might not be applicable now since it sounds like the server is already deployed, but might be helpful in the future:

  • Put a password on the BIOS
  • Use the front cover bezel to disable access to the hard drives, DVD-ROM, front USB ports, and front video port. I think there's a BIOS setting to disable the rear video and usb ports, but can't find it in their docs. The logic is the only way to service the machine is through the front ports which require a key that only you have. Worst case you could render the rear ports physically inoperable.
  • The R310 offers intrusion alert.
  • The R310 can boot from an internal usb key.
  • The R310 lists several more things in its manual about physical security that might be applicable.

With Dell's OpenManage I believe you can change some BIOS settings from the operating system assuming you install their tools for Linux so you might be able to do some of these now.

share|improve this answer
I want to avoid BIOS because. Using Serial console port i will never have BIOS mode and want to do as you mentioned from Operating system security. – YumYumYum Jun 27 '11 at 5:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.