Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can access to CD-ROM and USB be disabled for normal users in Linux?

As a part of security policy we need to disable CD-ROM and USB access for normal users. Only root users should have the access. We are mainly using Ubuntu Linux.

share|improve this question
    
Why is this a CW? –  Chris S Jun 18 '10 at 18:32

7 Answers 7

How about trying

chkconfig haldaemon off

This will prevent a normal user from seeing removable media devices. Only root will then be able to access removable media.

share|improve this answer

My coworker and I were trying this on Ubuntu 10.04 64 bit Desktop.

We had one admin user and one desktop user. We tried removing the desktop user from cdrom and plugdev in /etc/group, but that didn't work.

We then made admin own /media. We then chmodded /media to like:

chmod 700 /media

This seems to work. Also, I'm not worried about desktop user manually mounting because he doesn't have privileges.

Does this make sense? Do you guys see any weaknesses?

share|improve this answer

The easiest I've found is simply:

sudo chmod 700 /media

Ubuntu mounts removable media in /media, so changing permissions for /media is the easiest way to prevent access.This is a safe and easily reversible solution.

share|improve this answer

Easier is to remove users from the 'cdrom' and 'plugdev' groups in /etc/group.

share|improve this answer
up vote 2 down vote accepted

Found a solution to my issue.

Disabling USB

# mv /lib/modules/$(uname -r)/kernel/drivers/usb/storage/usb-storage.ko /root

Disabling CDROM

# mv  /lib/modules/$(uname -r)/kernel/drivers/cdrom/cdrom.ko /root

http://www.cyberciti.biz/faq/linux-disable-modprobe-loading-of-usb-storage-driver/

http://blog.ask4itsolutions.com/2010/05/07/disable-block-cddvd-rom-linux-rhel/

share|improve this answer
    
But this will disable access also for root, doesn't it? –  mkudlacek Jun 23 '10 at 7:38
    
Yes root also, but root can easily enable it by moving back.This may not be an ideal solution, but it is okay in my case. –  nitins Jun 23 '10 at 8:48
    
This is an worst possible solution(above solution).I think people need to look into their /etc/fstab file for that kind of manipulation.If they take out "nouser" option from the cdrom/dvd line in /etc/fstab file then the desired result can be achieved .Moving out and in modules like that is a bad very bad option. –  unixbhaskar Jun 24 '10 at 10:56
1  
Yes, agree. askvictor's answer is better. –  nitins Jun 24 '10 at 11:14

For simple protection against non-advanced users blacklisting the usb-storage module should be enough:

modprobe -r usb-storage
echo blacklist usb-storage >> /etc/modprobe.d/blacklist

To verify:

modprobe usb-storage
if ! lsmod | grep -q usb-storage; then echo Module is blacklisted; fi

For CD-ROM simply remove the user from the 'cdrom' group. Then the user should not be able to access it (in user management there is an advanced tab where you can uncheck such option).

share|improve this answer

It used to be that on *nix systems you would do this by changing the read-write permissions on the devices nodes. I suspect you're going to need to look for something more involved in Ubuntu -- perhaps user groups that grant access to devices classes, disabling hardware services such as hal, or perhaps changing the automount system so things get mounted only for privileged users. USB will be more complicated than CDROM because I assume you don't want to block the whole bus. You want usb mice to work but flash disks to be blocked right?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.