I'm disgusted with myself for not knowing the answer to this one, as I consider myself a fairly low-level hackerly type, but:

How do I disable the USB port on a machine? This is so that if a pendrive is stuck into it, nothing will happen, i.e. no viruses which can attack the machine etc.

The guy I know who wants this has WINDOZE machines on which he wants this done, but anyway I plan to migrate his office to Linux, after which I'd be wanting the above functionality.

Thanks for your help, you guys

Disable it in you're BIOS settings

or you can unload USB driver module from kernel and put it on blacklist, so that kernel won't load it automatically...

No I need this on a GUI thingy - his situation is, people come to his office with pendrives, and he would like to disable them being able to plug in anything into the system cause he's afraid of viruses. But he needs to be able to click this on and off, as according to whether such ppl have landed up *at* his office or not. It's a valid situation, and I'd like to think Linux would be able to handle this.
And Angel, that wouldn't be a good idea, cause Like I said it has to be on a clickable interface, but anyway, what if the driver has not been compiled separately, i.e. there's no .o file to rmmod? Is there a way to unload the driver in this case?

What about usb keyboards and mouse. Maybe it's better to make a script with a nice menu for him where he can give and take user rights to mount usb pendrives comfortable from his desk .

not to sound stupid but wouldn't migrating him to linux take care of the virus issue anyways
however if its a matter of not waning pendrives then perhaps the better answer is just to disable automounting of pen drives and make sure that standard users don't have permission to mount ANYTHING

You could disable automount feature of GNOME/KDE/whatever and restrict normal users from mounting any volumes. Then, as the mount is needed, a password could be entered to mount the drive. This can of course be scripted to be clickable (something like a controllable daemon which would change needed settings if a script asks it to do this).

You may find Documentation/usb/authorization.txt in the kernel source useful:

THIS is the info I was looking for, thanks so much.