Disable USB storage in linux

To protect data from leaks, we use software and hardware firewalls to limit unauthorized access from the outside, but data leaks can also occur internally. To eliminate this possibility, agencies restrict and monitor access to the Internet and disable USB storage devices.

In this tutorial, we will discuss three different methods to disable USB storage devices on Linux machines. All three methods are tested on CentOS 6&7 machines. So let us discuss these three methods one by one.

(Also read: Ultimate guide to securing SSH sessions[1])

In this method, we add a line install usb-storage /bin/true to the configuration file, which will actually turn the installation of the usb-storage module into running /bin /true, This is why this method is called pseudo installation. Specifically, create and open a file named block_usb.conf (it may also be called other names) in the folder /etc/modprobe.d,

$ sudo vim /etc/modprobe.d/block_usb.conf

Then add the following content:

install usb-storage /bin/true

Finally save the file and exit.

This method requires us to delete or move the USB storage driver (usb_storage.ko) so that the USB storage device can no longer be accessed. Execute the following command to move the driver from its default location:

$ sudo mv /lib/modules/$(uname -r)/kernel/drivers/usb/storage/usb-storage.ko /home/user1

The driver is no longer found in the default location, so the driver cannot be loaded when the USB memory is connected to the system, rendering the disk unusable. But there is a small problem with this method, that is, when the system kernel is updated, the usb-storage module will appear in its default location again.

We can also blacklist usb-storage through the /etc/modprobe.d/blacklist.conf file. This file is available on RHEL/CentOS 6, but you may need to create it yourself on 7. To blacklist the USB storage, use vim to open/create the above file:

$ sudo vim /etc/modprobe.d/blacklist.conf

And enter the following line to blacklist USB:

blacklist usb-storage

Save the file and exit. usb-storage will be blocked by the system from loading, but this method has a big disadvantage, that is, any privileged user can load usb-storage by executing the following command Module,

$ sudo modprobe usb-storage

This problem makes this method less than ideal, but for non-privileged users, this method works well.

Restart the system after the changes are completed for the changes to take effect. Please try these methods to disable USB storage and let us know if you encounter any problems or have any questions.

The above is the detailed content of Disable USB storage in linux. For more information, please follow other related articles on the PHP Chinese website!