2

I'm designing a security sensitive setup for a client. The situation is as follows:

Sensitive information has to be stored on a server that might be accessed by unauthorized personnel. There is no way to secure the hardware in a way that it is 100% secure.

Here my approach:

I'm encrypting the root machine with cryptsetup/luks, then I'm encrypting an image with cryptsetup/luks and mounting it to be a virtual machine's harddrive. The virtual machine has again an encrypted root FS.

Now I want to prevent anyone from accessing the machine's hardware while it is running. I want to detect unknown devices that are plugged into it, like a USB-thumbdrive or a Firewire device, etc.

Is there a way to detect unknown devices elegantly in udev? So far i've only found ways to define actions for devices I know. But I want to define an action for when an unknown device connects.

Thanks for your input.

0

1 Answer 1

1

If you want something like this you need to treat -all- devices as suspicious and at any time any device gets inserted ask for something only the owner of that device can know. You can not skip this for a device you believe has been approved before since the user that inserted it does not have to be the same person.

Is there a way to detect unknown devices elegantly in udev?

udev does not understand "unknown devices": it either understands all or none USB/firewire devices due to there being a entry in /dev/. Unknown to udev would mean the device does not work in that system. And ID_VENDOR_ID and ID_MODEL_ID do not allow you to see a difference between 2 devices of the same make and model.

A possible method:

See https://wiki.archlinux.org/index.php/Execute_on_USB_insert for a basic script that gets executed on inserting a device. This will force any device to show a menu where the user needs to verify it may have access.

The rule in the link ...

ACTION=="add", RUN+="/usr/bin/exdongle run /media/%k-%E{dir_name}"

will work on any device that tries to mount in /media/ and will start script "exdongle" (the script might need some tweaking since it has a disclaimer).


What you consider "unknown" is a specific device that is known to Linux as USB. So if USB support is present all USB devices are treated equally. Devices have a vendor and product id but those are unique per make/model and not per USB device.


The only USB device that has a unique ID is a dongle ( http://en.wikipedia.org/wiki/Software_protection_dongle ). Those tend to come with software for verification (so also not for headless systems) but you might be able to save the identification to a file and script something like above to test against a known set of id's.

4
  • I feared this would not be possible. The script you proposed is a workaround but would not work since the machine should run headless. So no way of inputting something. But couldn't I define all 'allowed' devices with rules, and add a 'catch-all' rule for unknown devices as last rule? or would that be executed as well?
    – flowolf
    Sep 12, 2013 at 14:21
  • @flowolf added some more; the only USB with an ID is a dongle :)
    – Rinzwind
    Sep 12, 2013 at 15:04
  • at the moment it looks like scripting is the solution. a script that runs on every device and looks up the id it gets from udev to see if the device is known or unknown. thanks for your help!
    – flowolf
    Sep 13, 2013 at 8:30
  • Those are not unique. 2 sticks of the same brand and size have the size vendor ID and product ID. I can not think of anything but storing a hidden file on the stick that is password protected and has a unique string in it. And does someone remove it (by accident) the stick is a new stick.
    – Rinzwind
    Sep 13, 2013 at 9:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .