9 ms·
> In case the police or other thugs come busting in I like this wording. Disclaimer: Not a comment on current political happenings. But seriously, the use ca
by raxxorrax 6y ago
> In case the police or other thugs come busting in
I like this wording.
Disclaimer: Not a comment on current political happenings.
But seriously, the use case of disallowing USB sticks on devices is unnecessary hard to configure. Just an option to disallow certain device classes would be appreciated.
- microcolonel 6y agoThis is fairly straightforward with udev, a couple lines of config should be sufficient.
- pnutjam 6y agoany directions?
- bartvk 6y agoThis guide is pretty good: http://reactivated.net/writing_udev_rules.html http://reactivated.net/writing_udev_rules.html Some ten-odd years ago, I wrote how to create udev rules to execute a command after connecting a particular USB device: https://www.vankuik.nl/2008-12-19_Linux_USB_device_handling https://www.vankuik.nl/2008-12-19_Linux_USB_device_handling
- microcolonel 6y agoI think it would end up something like SUBSYSTEM=="block", SUBSYSTEMS=="usb", OPTIONS+="ignore_device" But don't quote me on that
- daraps 6y agoI just disable all hotplugging support in my OS. Anything plugged into the machine must be manually mounted, enabled, etc. This works really great for me as it's rare that anything is attached to this machine other than the charger.
- InsomniacL 6y agohow would you authenticate the USB stick that is allowed though? Without some sort of authentication mechanism an attacked could clone the device id of an allowed device. better than nothing though! :)
- the8472 6y agoThere's the USB Authentication Protocol where devices identify themselves through digital signatures. But i don't know whether each device has a unique ID or its one cert for the whole production series.
- mschuster91 6y ago> But seriously, the use case of disallowing USB sticks on devices is unnecessary hard to configure. This will not help against hardware that exploits bugs in the USB stack of the operating system. Assuming the threat model is police or secret service seizing one's server, it is feasible that the attackers also have knowledge of the running OS (IIRC one can distinguish between Windows, Linux and xBSD by simply looking at TCP fingerprints) and thus can use a targeted exploit.
- agumonkey 6y agotypical social pattern: - nothing - hard work to make something easy to use - hard work to make something easy to control - control