2

The Problem

Disable all communications on all USB ports for all users (preferably remove power but as I'll point out below I don't think this is possible). I'm currently using Linux Mint 18.

What I Have Tried

None of the above seemed to work (tested by using a USB mouse & memory stick).

I haven't gotten round to trying the suggestion in unix.stackexchange.com/questions/274203 yet (which might disable keyboards and mice), however, allowing root to subvert blacklists is also not allowed.

I get the feeling that removal of drivers may be the best solution (placing in root for testing at least), but I'd need to know which drivers to target so that I don't break anything else.

I'd kind of prefer not having to get the soldering kit out to make a hardware adjustment if at all possible...

Improve this question
1
  • If you're going to vote me down could I at least have a reason for why? – user3303504 Jun 23 '17 at 19:05
1

Another option would be to add the "nousb" option to the kernel boot line, either at boot, or editing the /etc/default/grub file or /boot/grub.cfg

RedHat 7 did this when selecting the DISA Stig security profile. Took me a bit to figure out why my mouse and keyboard stopped working.

Improve this answer
0

I have an option in the BIOS to disable all USB ports. I have disabled camera, microphone & bluetooth.

For security reasons is good to disable USB ports. Many companies do it. However if you want to do it in Linux, there is a driver called "usb-storage". Try removing it, or if not possible, try forbidding it (blacklisting it).

As said in the discussion, try blacklisting it. Go to /etc/modprobe.d/blacklist.conf and add blacklist usb-storage

See the discussion in OpenSUSE: https://forums.opensuse.org/showthread.php/441492-how-to-disable-usb-storage

Improve this answer
1
  • As referenced in the question, this should block storage devices only. However, I need to block all USB devices. Also, I have now tried implementing both the blacklisting of usb-storage and usbhid. Usbhid successfully prevents mice, however, usb sticks still mount and load for all users. – user3303504 Jun 24 '17 at 14:53
0

You can add a udev rule similar to this:

ENV{ID_SERIAL}!="?*", SUBSYSTEMS=="usb", RUN+="/usr/bin/usbdevinserted.sh"

And, in usbdevinserted.sh, add commands to lock access to this USB.

Also, you can remove users from usb group (or other group that provides access to usb devices)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.