how to disable USB port

visitnag · 12-24-2008, 07:42 PM

I have some stand alone clients(for RHEL4AS SERVER) which are having USB ports. I want to disable these usb ports to stop data theft. How to disable this?

amani · 12-24-2008, 07:44 PM

You restrict users...through groups ...not disable usb

visitnag · 12-25-2008, 02:47 AM

Ok! but how to restrict users in client pcs? I dont want users to read or write or copy data into the system thru usb(especially pendrive)

Junior Hacker · 12-25-2008, 04:42 AM

You can more than likely disable USB controller in computer setup (bios) at start-up, then password protect the bios if the mother board supports it to avoid users re-enabling it.

hasanatizaz · 12-25-2008, 05:27 AM

i havent tried this but you can remove usb_storage from the kernel.

visitnag · 12-31-2008, 11:20 AM

I wanted to disable...the device...not to permanently remove. Whenever i want i could enable the same...

farslayer · 12-31-2008, 01:28 PM

you could try removing users from the plugdev group..

although the quote I am posting is from a guy that said this had no effect for him.. so he went hardcore into HAL policies, to block access to USB storage and CDROM Drives...

Quote:

Originally Posted by getut

http://ubuntuforums.org/archive/index.php/t-623829.html

What I found is HAL policies and I did tons of searching and could find no examples of people using the policies to block all removable drive access, but I did find snippets here and there all over the place good enough to put me on the right track.

Disclaimer, the way I will describe below does not seem to be the "recommended" way to use policies. The default policies in Ubuntu Gutsy have a 10osvendor folder and a 20thirdparty folder located in /usr/share/hal/fdi/policies. The 10osvendor folder contains policy files (.fdi) that control how devices are handled by the system... not just drives and media.. but pretty much all hardware such as keyboards and mice, scanners, etc. ObFrom the reading that I did, the 10osvendor polices are not really supposed to be changed, but instead there should be a 30user folder created and custom policies by the user should be put there. *** I could never get any policy in the 30user folder to take effect. *** I finally ended up editing 20-storage-methods.fdi policy file in the 10osvendor folder and the systems would honor the changes.

Basically I just added the following 6 lines anywhere ABOVE the  section. Just in case the exact location is critical, I actually added the lines after the  section. Here are the 6 lines:

Code:

<match key="@block.storage_device:storage.removable" bool="true">
<merge key="volume.ignore" type="bool">true</merge>
</match>

<match key="storage.drive_type" string="cdrom">
<merge key="volume.ignore" type="bool">true</merge>
</match>

Obviously, the first 3 lines take care of USB drives, the second 3 takes care of optical devices. There is very likely a cleaner way to do this. If anyone knows please provide input to the thread, but otherwise, this worked for me and hopefully can help someone else.

too bad pessulus doesn't have an option for USB storage devices.