LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 05-21-2019, 11:50 AM   #1
FBorges22
LQ Newbie
 
Registered: Sep 2006
Posts: 8

Rep: Reputation: 0
Disallow users to mount usb flash drives or HDD


Hi there,

I am looking for a precise way to block the users from mount USB mass storage devices (i.e., flash drives, hard disks and etc) in my Debian 9 diskless stations.

I checked the PolicyKit instructions but I still have no idea in how to prevent the users from the users from mounting USB media.

Disabling the udisks2 service is not working and even if I can stop the udisks2 he can start again and allow the users to mount their removeable usb media normally. I need to secure my server and cannot allow anyone mount their media on the server.

Best regards,
F.Borges
 
Old 05-21-2019, 01:01 PM   #2
teckk
Senior Member
 
Registered: Oct 2004
Distribution: FreeBSD Arch
Posts: 2,130

Rep: Reputation: 407Reputation: 407Reputation: 407Reputation: 407Reputation: 407
Couple of thoughts

Remove the kernel module
Code:
mv /lib/modules/$(uname -r)/kernel/drivers/usb/storage/usb-storage.ko /home/somewhere
Use you own path, on arch something like
Code:
/usr/lib/modules/5.0.9-arch1-1-ARCH/kernel/drivers/usb/storage/usb-storage.ko.xz
Blacklist usb storage
Code:
cat /etc/modprobe.d/blacklist.conf
blacklist usb-storage
Or modprobe -r usb-storage

You can modprobe it back though.

Turn off usb in BIOS/UEFI

Deny access
Code:
chmod 000 /media
Grub, in grub.conf or menu.lst, add nousb to kernel line

lsusb to see whats attached, then
Code:
echo "disabled" > /sys/bus/usb/devices/usbX/power/wakeup
echo "suspend" > /sys/bus/usb/devices/usbX/power/level
On this arch box
Code:
cat /sys/bus/usb/devices/usb1/power/wakeup
disabled
I think that you could also do that with sysctl -w

Then there is
Code:
pacman -Si usbguard
...
Description     : Software framework for implementing USB device authorization
                  policies
Architecture    : x86_64
URL             : https://github.com/dkopecek/usbguard
Licenses        : GPL2
Groups          : None
Provides        : libusbguard.so=0-64
Depends On      : glibc  libqb  libqb.so=0-64  libsodium  libcap-ng  protobuf
                  polkit  dbus-glib
...
Download Size   : 394.82 KiB
Installed Size  : 1514.00 KiB
...
https://wiki.archlinux.org/index.php/USBGuard
 
3 members found this post helpful.
Old 05-21-2019, 10:53 PM   #3
proMusic
LQ Newbie
 
Registered: May 2019
Posts: 20

Rep: Reputation: Disabled
Check out usbguard

To start protecting your system, you can use the USBGuard shell command and its generate-policy sub-command to generate an initial policy for your system instead of writing one from scratch. The tool generates an allow policy for all devices currently connected to your system.

Code:
sudo apt-get update ; sudo apt-get install usbguard
usbguard generate-policy > rules.conf
sudo install -m 0600 -o root -g root rules.conf /etc/usbguard/rules.conf
sudo systemctl restart usbguard

Last edited by proMusic; 05-21-2019 at 10:56 PM.
 
1 members found this post helpful.
Old 05-22-2019, 09:50 AM   #4
FBorges22
LQ Newbie
 
Registered: Sep 2006
Posts: 8

Original Poster
Rep: Reputation: 0
Thanks for the help. I also successfully blocked the USB mounting with the policykit by adding the following rule at /etc/polkit-1/localauthority/50-local.d by creating the file disallow-mounting.pkla with the following contents:

Quote:
[Dissallow users to mount devices]
Identity=unix-group:users
Action=org.freedesktop.udisks2.*
ResultAny=no
ResultInactive=no
ResultActive=no
What do you think of the use of PolicyKit to block mounting all mass storage devices?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Encrypted HDD/flash drive or HDD/flash drive encryption ilesterg Linux - Security 4 09-27-2016 07:42 PM
Allow/disallow users to logging in a domain machine with SAMBA tetroll Linux - Server 5 07-23-2010 08:06 AM
Postfix - disallow some users to send internet mail dtournas Linux - Software 2 08-21-2009 08:10 PM
fedora 8 vs fedora 9 - does pam_mount disallow 'exec' mount flag? whysyn Fedora 5 06-02-2008 08:58 AM
udev, USB Flash Drives, and usb-mount talkingwires Debian 13 11-07-2004 12:15 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 02:02 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration