1

I have a requirement to disable USB thumb drives, while still allowing other USB devices such as a portable hard drive.

Is there a way to do this in Linux? I know the Windows side has some software that enforces this, and need to do the same on Linux.

2
  • What is the difference between a thumb drive and an external hard drive? :)
    – lorenzog
    Nov 9 '10 at 14:15
  • 2
    I would go back to management and make them define a thumb drive. Tell them that plug in harddrives and thumbdrives are, to the system, the same thing. Find out what risk they are trying to address. The right solution from a security standpoint is to just ban mass storage devices, and allow them to individual users that understand, and have signed, an advanced security policy.
    – mfarver
    Nov 9 '10 at 14:35
2

You can write a hal policy to make some forms of media unmountable. I'm not quite sure how you'd distinguish a thumb drive from a hard drive though.

6
  • Maybe a script that says anything under ~32 gig in size wouldn't mount...not many USB thumb drives are high capacity. But this isn't a kludge I'd want to maintain. But why allow hard disks but not thumbdrives? Nov 9 '10 at 14:07
  • Unfortunately it's just a bad requirement made by upper management.
    – specto
    Nov 9 '10 at 14:16
  • I like your idea about the less than 32gb, however I have no idea how I would implement this. Any insight would be nice. Thanks
    – specto
    Nov 9 '10 at 14:21
  • 1
    The storage.size property contains the detected size of the volume. Nov 9 '10 at 14:24
  • @specto: If UM believes that the difference is that a thumb drive is easier to physically conceal, then I can show you a moving-platter storage device that's not much bigger than a thumb drive. Nov 9 '10 at 18:38
2

I would definitely seek clarification from management and try to get them to define a better policy.

Also, take a look at writing udev rules, there are some things you can do there that might help. For example, you could write a rule that only mounts USB mass storage devices that are a particular model and/or a particular vendor. I think you could write a rule that would only mount a Maxtor One Touch and ignore anything else.

http://reactivated.net/writing_udev_rules.html

If the concern is that people are stealing data, you could mount everything read only.

If the concern is that people are unwittingly bringing in malware on thumb drives, then you could probably create a udev rule that runs clamav on the drive as soon as it's mounted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.