Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm designing a security sensitive setup for a client. The situation is as follows:

Sensitive information has to be stored on a server that might be accessed by unauthorized personnel. There is no way to secure the hardware in a way that it is 100% secure.

Here my approach:

I'm encrypting the root machine with cryptsetup/luks, then I'm encrypting an image with cryptsetup/luks and mounting it to be a virtual machine's harddrive. The virtual machine has again an encrypted root FS.

Now I want to prevent anyone from accessing the machine's hardware while it is running. I want to detect unknown devices that are plugged into it, like a USB-thumbdrive or a Firewire device, etc.

Is there a way to detect unknown devices elegantly in udev? So far i've only found ways to define actions for devices I know. But I want to define an action for when an unknown device connects.

Thanks for your input.

share|improve this question
add comment

1 Answer

If you want something like this you need to treat -all- devices as suspicious and at any time any device gets inserted ask for something only the owner of that device can know. You can not skip this for a device you believe has been approved before since the user that inserted it does not have to be the same person.

Is there a way to detect unknown devices elegantly in udev?

udev does not understand "unknown devices": it either understands all or none USB/firewire devices due to there being a entry in /dev/. Unknown to udev would mean the device does not work in that system. And ID_VENDOR_ID and ID_MODEL_ID do not allow you to see a difference between 2 devices of the same make and model.

A possible method:

See https://wiki.archlinux.org/index.php/Execute_on_USB_insert for a basic script that gets executed on inserting a device. This will force any device to show a menu where the user needs to verify it may have access.

The rule in the link ...

ACTION=="add", RUN+="/usr/bin/exdongle run /media/%k-%E{dir_name}"

will work on any device that tries to mount in /media/ and will start script "exdongle" (the script might need some tweaking since it has a disclaimer).


What you consider "unknown" is a specific device that is known to Linux as USB. So if USB support is present all USB devices are treated equally. Devices have a vendor and product id but those are unique per make/model and not per USB device.


The only USB device that has a unique ID is a dongle ( http://en.wikipedia.org/wiki/Software_protection_dongle ). Those tend to come with software for verification (so also not for headless systems) but you might be able to save the identification to a file and script something like above to test against a known set of id's.

share|improve this answer
    
I feared this would not be possible. The script you proposed is a workaround but would not work since the machine should run headless. So no way of inputting something. But couldn't I define all 'allowed' devices with rules, and add a 'catch-all' rule for unknown devices as last rule? or would that be executed as well? –  flowolf Sep 12 '13 at 14:21
    
@flowolf added some more; the only USB with an ID is a dongle :) –  Rinzwind Sep 12 '13 at 15:04
    
at the moment it looks like scripting is the solution. a script that runs on every device and looks up the id it gets from udev to see if the device is known or unknown. thanks for your help! –  flowolf Sep 13 '13 at 8:30
    
Those are not unique. 2 sticks of the same brand and size have the size vendor ID and product ID. I can not think of anything but storing a hidden file on the stick that is password protected and has a unique string in it. And does someone remove it (by accident) the stick is a new stick. –  Rinzwind Sep 13 '13 at 9:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.