I want to block all usb devices except usb keyboard and usb mouse using udev rules? The purpose is to restrict users from attaching external storage devices (flash drives, phone internal storage and iOS devices storage).
To restrict users from transferring data to these device from Ubuntu machine with 16.04 and above.
Restricting mtp mobile transger protocol as well for restricting photo transfer.
Login to the machine with sudo rights in the terminal.
# Sudo –i
List the usb ports:
#lsmod |grep usb
Edit the blacklist.conf file
# Sudo vi /etc/modeprobe.d/blacklist.conf
blacklist usb_storge
blacklist uas
blacklist usbhid
#Sudo vi /etc/rc.local/
modprobe -r usb_storage
modprobe -r uas
modprob usbhid
save Restart machine.
but some how mobile storage manages to connect storage to machine .
so trying the udev rules now , i have tried following for all ports(usb/1-3,usb1/1-3..) but it block kb mouse too
#echo 0 > / sys/bus/usb/devices/1-3/authorized
other option i tried:
/etc/udev/rules.d/01-usblockdown.rules
The contents of the script are as follows:
#Script by Adrian Crenshaw
#With info from Michael Miller, Inaky Perez-Gonzalez and VMWare
#By default, disable it.
#ACTION=="add", SUBSYSTEMS=="usb", RUN+="/bin/sh -c 'echo 0 >/sys$DEVPATH/authorized'"<br>
ACTION=="add", SUBSYSTEMS=="usb", RUN+="/bin/sh -c 'for host in /sys/bus/usb/devices/usb*; do echo 0 > $host/authorized_default; done'"
#Enable hub devices. There may be a better way than this.
ACTION=="add", ATTR{bDeviceClass}=="09", RUN+="/bin/sh -c 'echo 1 >/sys$DEVPATH/authorized'"
#Other things to enable
ACTION=="add", ATTR{idVendor}=="046d", ATTR{idProduct}=="0809", RUN+="/bin/sh -c 'echo 1 >/sys$DEVPATH/authorized'"
ACTION=="add", ATTR{serial}=="078606B90DD3", RUN+="/bin/sh -c 'echo 1 >/sys$DEVPATH/authorized'"
ACTION=="add", ATTR{product}=="802.11 n WLAN", RUN+="/bin/sh -c 'echo 1 >/sys$DEVPATH/authorized'"
#ACTION=="add", ATTR{idVendor}=="413c", ATTR{idProduct}=="2106", RUN+="/bin/sh -c 'echo 1 >/sys$DEVPATH/authorized'"
It also blocks the usb keyboard and mouse.