Disable mounting removable media

pavangogineni · 10-18-2006, 06:58 AM

Hi,

I would like to disable mounting the removable media like CD-Rom, USB, Floppy etc.. on the server.

How can I achieve it. Also how to enable it whenever I required?

I am using RHEL 4 AS version.

carl0ski · 10-18-2006, 07:04 AM

Quote:

Originally Posted by pavangogineni

Hi,

I would like to disable mounting the removable media like CD-Rom, USB, Floppy etc.. on the server.

How can I achieve it. Also how to enable it whenever I required?

I am using RHEL 4 AS version.

do you Disable auto mount or prevent mounting period?

If you disable or uninstall HAL (engine that scans for new disks)
USB cd/dvd wont be mounted unless you use the full mount -t command.

matthewg42 · 10-18-2006, 08:16 AM

It's a bit of a hack, and it'll probably end up making lots of warning/error messages in the system logs, and it is only for USB devices, but IF your setup has the usb_storage kernel module compiled as a module (and not simply built into the kernel itself), you can blacklist the usb_module kernel module. I tried it, and it works on Ubuntu.

In Ubuntu this can be done by creating a file in /etc/modprobe.d (with any name), containing:

Code:

blacklist usb_storage

Not sure how to do the same thing in RHEL. Anyone know?

pavangogineni · 10-19-2006, 01:42 AM

Here I would like to disable automount and also using command (mount -t .......).
That is whenever anyone tries to mount any USB/CD/any removable media to copy some data it shouldn't allow them to do so.
Only I (superuser) want to enable mounting it whenever I required.

Is there anything possible to lock the mount process to work only for UID 0 or something like that???
If so is there any problem when the system boots??
I tried to rename the mount command and it worked fine. But when the system boots it fails to locate the "mount" command to mount the disks and it hangs. Where are the modifications I need to do this.

carl0ski · 10-19-2006, 02:08 AM

Quote:

Originally Posted by pavangogineni

Here I would like to disable automount and also using command (mount -t .......).
That is whenever anyone tries to mount any USB/CD/any removable media to copy some data it shouldn't allow them to do so.
Only I (superuser) want to enable mounting it whenever I required.

Is there anything possible to lock the mount process to work only for UID 0 or something like that???
If so is there any problem when the system boots??
I tried to rename the mount command and it worked fine. But when the system boots it fails to locate the "mount" command to mount the disks and it hangs. Where are the modifications I need to do this.

Hey i just had an idea so great its Petarded

Code:

alias mount='echo "access to removable devices has been disabled"

Add this line to a startup script (after all devices have been mounted)
on Mandriva i have no idea else where
/etc/rc.local (the last list of command before prompt is shown)

this way noone can use mount
effects are not permanent and your drives will still mount at bootup.

Gatekeeper:~ # mount
access to removable devices has been disabled
Gatekeeper:~ #

pavangogineni · 10-19-2006, 03:04 AM

But what about automount???

Lotharster · 10-19-2006, 04:25 AM

Quote:

Originally Posted by carl0ski

Hey i just had an idea so great its Petarded

Code:

alias mount='echo "access to removable devices has been disabled"

This is very easy to circumvent: just call mount with its full path (/bin/mount).

The safe way to do this would be to edit /etc/fstab and add "nouser" to the usb storage line:

Code:

/dev/sda1       /media/usb      auto    nouser,noauto        0      0

This should effectively prevent anyone from mounting usb devices. The normal mount command with mount point and options can only be executed by root (at least on my system, ubuntu).

Regards,
Lothar

evilDagmar · 10-19-2006, 11:24 AM

Quote:

Originally Posted by carl0ski

Hey i just had an idea so great its Petarded

Code:

alias mount='echo "access to removable devices has been disabled"

Add this line to a startup script (after all devices have been mounted)
on Mandriva i have no idea else where
/etc/rc.local (the last list of command before prompt is shown)

this way noone can use mount
effects are not permanent and your drives will still mount at bootup.

Gatekeeper:~ # mount
access to removable devices has been disabled
Gatekeeper:~ #

You used the words, not me, but this is a somewhat retarded solution which can be easily bypassed by someone invoking mount with it's full path, or by simply deleting the alias from the shell.

evilDagmar · 10-19-2006, 11:26 AM

Quote:

Originally Posted by pavangogineni

Here I would like to disable automount and also using command (mount -t .......).
That is whenever anyone tries to mount any USB/CD/any removable media to copy some data it shouldn't allow them to do so.
Only I (superuser) want to enable mounting it whenever I required.

Is there anything possible to lock the mount process to work only for UID 0 or something like that???
If so is there any problem when the system boots??
I tried to rename the mount command and it worked fine. But when the system boots it fails to locate the "mount" command to mount the disks and it hangs. Where are the modifications I need to do this.

If you kill off (or simply don't run) the automounter that takes care of auto-mounting, and if you'r e not using HAL/dbus there's nothing else that's likely to be able to automatically mount things.

Users can not, by default, mount anything. As long as you don't have anything in /etc/fstab saying they can mount media, only root will be able to do this.