Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

For security reasons, I would like to make sure no USB device can be connected to my servers running RHEL3 except keyboards, mice and flash drives. To sum up :

What should work :

  • Mouse
  • Keyboard
  • USB storage device

What shouldn't work :

  • Printer
  • USB modem/NIC
  • Wifi dongle
  • anything else

Is there any other way than removing according kernel drivers ? If not, which files should be kept in order to keep functionality of accepted devices?

Side-note : some hosts are VMware VMs running on ESXi 4.1 or 5.0. That may be important since I think they may emulates important USB devices (I think about virtual DVD drives which I could need)

share|improve this question
    
Why on earth do you still have servers running RHEL 3? –  Michael Hampton Sep 3 '13 at 8:53
    
Because migration to newer OS is planified but will take a lot of time... –  Kwaio Sep 3 '13 at 9:13
    
Can't you just setup some udev rules? –  ott-- Sep 3 '13 at 9:40
    
Nope, udevis a feature of 2.6 kernel. RHEL3 is 2.4 =/ –  Kwaio Sep 3 '13 at 9:45

1 Answer 1

You can easily force and disable USB storage devices under any Linux distribution. The modprobe program used for automatic kernel module loading and can be configured to not load the USB storage driver upon demand. This will prevent the modprobe program from loading the usb-storage module, but will not prevent root (or another program) from using the insmod program to load the module manually.

Type the following command:

echo 'install usb-storage : ' >> /etc/modprobe.conf

You can also remove USB Storage driver, enter:

ls /lib/modules/$(uname -r)/kernel/drivers/usb/storage/usb-storage.ko

mv /lib/modules/$(uname -r)/kernel/drivers/usb/storage/usb-storage.ko /root

BIOS option

You can also disable USB from system BIOS configuration option. Make sure BIOS is password protected.

Grub option

You can get rid of all USB devices by disabling kernel support for USB via GRUB. Open grub.conf or menu.lst (Under Debian / Ubuntu Linux) and append "nousb" to the kernel line as follows:

kernel /vmlinuz-2.6.18-128.1.1.el5 ro root=LABEL=/ console=tty0 console=ttyS1,19200n8 nousb

Save and close the file. Once done just reboot the system:

reboot

Source

share|improve this answer
    
Thanks for the extensive answer but it does not totally solve my problem. I want to disable all USB devices BUT mice, keyboards and flash drives. That means disable printers, disable Wireless USB sticks etc. see what I want ? –  Kwaio Sep 3 '13 at 9:15
1  
That answers would still be helpful for anyone with the basic need of totally disabling USB. –  Kwaio Sep 3 '13 at 9:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.