Help answer threads with 0 replies.
Go Back > Forums > Linux Forums > Linux - Security
User Name
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.


  Search this Thread
Old 05-21-2019, 11:50 AM   #1
LQ Newbie
Registered: Sep 2006
Posts: 8

Rep: Reputation: 0
Disallow users to mount usb flash drives or HDD

Hi there,

I am looking for a precise way to block the users from mount USB mass storage devices (i.e., flash drives, hard disks and etc) in my Debian 9 diskless stations.

I checked the PolicyKit instructions but I still have no idea in how to prevent the users from the users from mounting USB media.

Disabling the udisks2 service is not working and even if I can stop the udisks2 he can start again and allow the users to mount their removeable usb media normally. I need to secure my server and cannot allow anyone mount their media on the server.

Best regards,
Old 05-21-2019, 01:01 PM   #2
Senior Member
Registered: Oct 2004
Distribution: FreeBSD Arch
Posts: 2,129

Rep: Reputation: 407Reputation: 407Reputation: 407Reputation: 407Reputation: 407
Couple of thoughts

Remove the kernel module
mv /lib/modules/$(uname -r)/kernel/drivers/usb/storage/usb-storage.ko /home/somewhere
Use you own path, on arch something like
Blacklist usb storage
cat /etc/modprobe.d/blacklist.conf
blacklist usb-storage
Or modprobe -r usb-storage

You can modprobe it back though.

Turn off usb in BIOS/UEFI

Deny access
chmod 000 /media
Grub, in grub.conf or menu.lst, add nousb to kernel line

lsusb to see whats attached, then
echo "disabled" > /sys/bus/usb/devices/usbX/power/wakeup
echo "suspend" > /sys/bus/usb/devices/usbX/power/level
On this arch box
cat /sys/bus/usb/devices/usb1/power/wakeup
I think that you could also do that with sysctl -w

Then there is
pacman -Si usbguard
Description     : Software framework for implementing USB device authorization
Architecture    : x86_64
URL             :
Licenses        : GPL2
Groups          : None
Provides        :
Depends On      : glibc  libqb  libsodium  libcap-ng  protobuf
                  polkit  dbus-glib
Download Size   : 394.82 KiB
Installed Size  : 1514.00 KiB
3 members found this post helpful.
Old 05-21-2019, 10:53 PM   #3
LQ Newbie
Registered: May 2019
Posts: 20

Rep: Reputation: Disabled
Check out usbguard

To start protecting your system, you can use the USBGuard shell command and its generate-policy sub-command to generate an initial policy for your system instead of writing one from scratch. The tool generates an allow policy for all devices currently connected to your system.

sudo apt-get update ; sudo apt-get install usbguard
usbguard generate-policy > rules.conf
sudo install -m 0600 -o root -g root rules.conf /etc/usbguard/rules.conf
sudo systemctl restart usbguard

Last edited by proMusic; 05-21-2019 at 10:56 PM.
1 members found this post helpful.
Old 05-22-2019, 09:50 AM   #4
LQ Newbie
Registered: Sep 2006
Posts: 8

Original Poster
Rep: Reputation: 0
Thanks for the help. I also successfully blocked the USB mounting with the policykit by adding the following rule at /etc/polkit-1/localauthority/50-local.d by creating the file disallow-mounting.pkla with the following contents:

[Dissallow users to mount devices]
What do you think of the use of PolicyKit to block mounting all mass storage devices?


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Encrypted HDD/flash drive or HDD/flash drive encryption ilesterg Linux - Security 4 09-27-2016 07:42 PM
Allow/disallow users to logging in a domain machine with SAMBA tetroll Linux - Server 5 07-23-2010 08:06 AM
Postfix - disallow some users to send internet mail dtournas Linux - Software 2 08-21-2009 08:10 PM
fedora 8 vs fedora 9 - does pam_mount disallow 'exec' mount flag? whysyn Fedora 5 06-02-2008 08:58 AM
udev, USB Flash Drives, and usb-mount talkingwires Debian 13 11-07-2004 12:15 PM > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 04:29 AM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration