Problem Statement

In windows server to provide access to USB devices are managed by GFI EndpointSecurity. Is there any open source tool in Linux which can do the same job. I want to block USB devices based on device class. I am looking for a add-on or some set of commands. I want to install the add-on in Linux server and provide access to client systems based on groups.

tried out

I have seen post on 'how to block usb storage devices in linux'. as shown here.

  • I guess you could write custom udev rules that accept or reject certain USB devices based on their class/IDs. I don't know if there's a readymade tool for that though. – Martin von Wittich Jan 30 '14 at 16:36
  • Since, on linux, one can set the default mount permissions to nodev,noexec,nosuid, there is little demand for such blocking. As @MartinvonWittich says, custom udev rules would do it. – John1024 Jan 30 '14 at 19:11

Blocking USB devices based on various attributes (including the class and/or protocol) or even conditions (e.g. "if this device is connected, then" or "if the local time is in this range, then") is possible using USBGuard.

Here's an example rule that blocks a specific class of USB devices:

block with-interface one-of { 02:*:* e0:*:* }

The rule will block any USB device that contains an interface from either the Wireless class (02:XX:XX) or Communications class (e0:XX:XX).

HW vendors don't always follow the USB class and protocol hierarchy and use a vendor specific class instead (FF:00:00) and implement the functionality in a vendor-specific driver instead. In that case, you'll have to block the device based on different attributes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.