Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #231557 > unrolled thread
| Started by | Bhasker C V <bhasker@unixindia.com> |
|---|---|
| First post | 2021-02-09 19:40 +0100 |
| Last post | 2021-02-13 01:20 +0100 |
| Articles | 5 — 4 participants |
Back to article view | Back to linux.debian.user
Allow only selected USB Bhasker C V <bhasker@unixindia.com> - 2021-02-09 19:40 +0100
Re: Allow only selected USB Darac Marjal <mailinglist@darac.org.uk> - 2021-02-09 19:50 +0100
Re: Allow only selected USB l0f4r0@tuta.io - 2021-02-09 20:50 +0100
Re: Allow only selected USB Bhasker C V <bhasker@unixindia.com> - 2021-02-09 23:40 +0100
Re: Allow only selected USB Toni Mas Soler <antomassol@protonmail.com> - 2021-02-13 01:20 +0100
| From | Bhasker C V <bhasker@unixindia.com> |
|---|---|
| Date | 2021-02-09 19:40 +0100 |
| Subject | Allow only selected USB |
| Message-ID | <BGG5z-4Fi-1@gated-at.bofh.it> |
Hi all, I know it is very useful that linux auto-detects a USB device when plugged in. However I am trying to build a server which employs deny first rule. That is, I don't want linux kernel to detect any USB device even if plugged in except those listed with a Vendor/device ID in a file (perhaps stored somewhere securely in the server). Is this possible ? I tried to skim though internet but could not find any useful information except some pages reporting how to disable USB storage. Please could someone help me with some pointers ? -- Bhasker C V Secure Mails: http://keys.gnupg.net/pks/lookup?op=get&search=0x4D05FEEC54E47413 Registered Linux User: #306349
[toc] | [next] | [standalone]
| From | Darac Marjal <mailinglist@darac.org.uk> |
|---|---|
| Date | 2021-02-09 19:50 +0100 |
| Message-ID | <BGGff-4IJ-7@gated-at.bofh.it> |
| In reply to | #231557 |
[Multipart message — attachments visible in raw view] — view raw
On 09/02/2021 18:38, Bhasker C V wrote: > Hi all, > > I know it is very useful that linux auto-detects a USB device when > plugged in. However I am trying to build a server which employs deny > first rule. That is, I don't want linux kernel to detect any USB > device even if plugged in except those listed with a Vendor/device ID > in a file (perhaps stored somewhere securely in the server). > > Is this possible ? I tried to skim though internet but could not find > any useful information except some pages reporting how to disable USB > storage. > > Please could someone help me with some pointers ? Certainly. https://www.kernel.org/doc/html/latest/usb/authorization.html
[toc] | [prev] | [next] | [standalone]
| From | l0f4r0@tuta.io |
|---|---|
| Date | 2021-02-09 20:50 +0100 |
| Message-ID | <BGHbj-5iv-3@gated-at.bofh.it> |
| In reply to | #231558 |
Hi, 9 févr. 2021, 19:44 de mailinglist@darac.org.uk: > Certainly. > https://www.kernel.org/doc/html/latest/usb/authorization.html > + https://usbguard.github.io based on it. Best regards, l0f4r0
[toc] | [prev] | [next] | [standalone]
| From | Bhasker C V <bhasker@unixindia.com> |
|---|---|
| Date | 2021-02-09 23:40 +0100 |
| Message-ID | <BGJPP-6Zx-1@gated-at.bofh.it> |
| In reply to | #231559 |
[Multipart message — attachments visible in raw view] — view raw
Fantastic ! thanks a ton ! thanks ! exactly what i was looking for On Tue, Feb 9, 2021 at 7:43 PM <l0f4r0@tuta.io> wrote: > Hi, > > 9 févr. 2021, 19:44 de mailinglist@darac.org.uk: > > > Certainly. > > https://www.kernel.org/doc/html/latest/usb/authorization.html > > > + https://usbguard.github.io based on it. > > Best regards, > l0f4r0 > >
[toc] | [prev] | [next] | [standalone]
| From | Toni Mas Soler <antomassol@protonmail.com> |
|---|---|
| Date | 2021-02-13 01:20 +0100 |
| Message-ID | <BHQPf-6K7-1@gated-at.bofh.it> |
| In reply to | #231569 |
[Multipart message — attachments visible in raw view] — view raw
Alternatively, if you run udev, you can add new rule.
Fixed: /etc/udev/rules.d
Volatile: /run/udev/rules.d
I believe this example is autoexplained:
8 # Do not use this rule if I'm not a USB
9 SUBSYSTEM!="usb", GOTO="usbgend"
10 # Only verify on plugin
11 ACTION=="remove", GOTO="usbgend"
12
13 # Select what you want accept by one attributes
22 SUBSYSTEM=="usb", ACTION=="add", ATTRS{manufacturer}=="PixArt", ATTRS{product}=="USB Optical Mouse", \
23 ATTRS{idVendor}=="0AEa", ATTRS{idProduct}=="2EE0", ATTRS{bDeviceClass}=="00", ATTR{authorized}="1", GOTO="usbgend"
24
25 # Select what you want accept by other attributes
30 ACTION=="add", SUBSYSTEM=="usb", ATTRS{idVendor}=="0124", ATTRS{idProduct}=="4312", ATTR{authorized}="1", GOTO="usbgend"
31
35 # Deactivate other USBs
36 SUBSYSTEM=="usb", ACTION=="add", ATTR{authorized}="0"
37
38 LABEL="usbgend"
Regards,
Toni Mas
GPG 3F42A21D84D7E950
Sent with ProtonMail Secure Email.
‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
En dimarts 9 de febrer de 2021 a les 23:31, Bhasker C V <bhasker@unixindia.com> va escriure:
> Fantastic ! thanks a ton ! thanks ! exactly what i was looking for
>
> On Tue, Feb 9, 2021 at 7:43 PM <l0f4r0@tuta.io> wrote:
>
> > Hi,
> >
> > 9 févr. 2021, 19:44 de mailinglist@darac.org.uk:
> >
> > > Certainly. > https://www.kernel.org/doc/html/latest/usb/authorization.html
> > >
> > + https://usbguard.github.io based on it.
> >
> > Best regards,
> > l0f4r0
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.user
csiph-web