How to disable CD-ROM and USB for normal users in Linux?

Question

How can access to CD-ROM and USB be disabled for normal users in Linux?

As a part of security policy we need to disable CD-ROM and USB access for normal users. Only root users should have the access. We are mainly using Ubuntu Linux.

Answer 1

Easier is to remove users from the 'cdrom' and 'plugdev' groups in /etc/group.

Answer 2

For simple protection against non-advanced users blacklisting the usb-storage module should be enough:

modprobe -r usb-storage
echo blacklist usb-storage >> /etc/modprobe.d/blacklist

To verify:

modprobe usb-storage
if ! lsmod | grep -q usb-storage; then echo Module is blacklisted; fi

For CD-ROM simply remove the user from the 'cdrom' group. Then the user should not be able to access it (in user management there is an advanced tab where you can uncheck such option).

Answer 3

Found a solution to my issue.

Disabling USB

# mv /lib/modules/$(uname -r)/kernel/drivers/usb/storage/usb-storage.ko /root

Disabling CDROM

# mv  /lib/modules/$(uname -r)/kernel/drivers/cdrom/cdrom.ko /root

http://www.cyberciti.biz/faq/linux-disable-modprobe-loading-of-usb-storage-driver/

http://blog.ask4itsolutions.com/2010/05/07/disable-block-cddvd-rom-linux-rhel/

Answer 4

How about trying

chkconfig haldaemon off

This will prevent a normal user from seeing removable media devices. Only root will then be able to access removable media.

Answer 5

It used to be that on *nix systems you would do this by changing the read-write permissions on the devices nodes. I suspect you're going to need to look for something more involved in Ubuntu -- perhaps user groups that grant access to devices classes, disabling hardware services such as hal, or perhaps changing the automount system so things get mounted only for privileged users. USB will be more complicated than CDROM because I assume you don't want to block the whole bus. You want usb mice to work but flash disks to be blocked right?