Results 1 to 8 of 8

Thread: Removable Storage Control/Auditing

  1. #1

    Default Removable Storage Control/Auditing

    Hi all,
    I'm looking for a product that will allow me to lockout USB removable storage on a Suse workstation, or to log all data copied to/from the device.
    Does anyone know of such a product?

    Thanks for any replies.

    Cheers,
    Chris

  2. #2
    Join Date
    Jun 2008
    Location
    Netherlands
    Posts
    29,748

    Default Re: Removable Storage Control/Auditing

    What about blacklisting the usb_storage module of he kernel? Or is that a bit to drastic.

    Edit: this came in a flash to my mind, I did not try this, but I think it will work.
    Henk van Velden

  3. #3

    Default Re: Removable Storage Control/Auditing

    Thanks Henk, I'm not an expert but I found this link. Is it what you had in mind?
    Linux Disable USB Devices (Disable loading of USB Storage Driver)

    Chris

  4. #4
    Join Date
    Jun 2008
    Location
    /dev/belgium
    Posts
    1,946

    Default Re: Removable Storage Control/Auditing

    Please do not double post!

  5. #5
    Join Date
    Jun 2008
    Location
    Netherlands
    Posts
    29,748

    Default Re: Removable Storage Control/Auditing

    First I hope you saw the complaints about you posting the same in more then one thread. That will really make a mess out of the discussion. Better not quite oin the correct forum then everywhere

    Maybe a mod can remove or block the other one.
    -----------------------------------------------

    I read your link and it seems that it starts from the same assumption as I did. Though I am not sure that the implementation there would work in openSUSE. See e.g. the difference between he mentioning usb-storage and I mentioning usb_storage. Mine is from an lsmod on my (10.3) system.

    I thougt there was a place in YaST where you could blacklist modules, but I can not find it.

    IMHO you should not edit /etc/modprobe.conf, but /etc/modprobe.conf.local.

    I do have /lib/modules/$(uname -r)/kernel/drivers/usb/storage/usb-storage.ko, so you could go for this solution. (see the - and not the _ in this name, maybe the module has the _ and the file the -)

    In any case write down what you did, so you can reverse easily (and make backup copies of files you ar going to edit). Do one test at the time. As this is rather easy to test I have no doubt you will find out if things function as you wish them.

    Maybe one of the gurus here comes up with the ideal way to do this in openSUSE, but there are always many way to do things in Unix/Linux.
    Henk van Velden

  6. #6

    Default Re: Removable Storage Control/Auditing

    Thanks Henk, I'll give it a go and test the results.

    Cheers,
    Chris

  7. #7

    Default Re: Removable Storage Control/Auditing

    FYI Henk it worked perfectly
    Hartstikke bedankt voor je help, nogmaals excuses voor de multiple posts. Het zou niet weer gebeuren

  8. #8
    Join Date
    Jun 2008
    Location
    Netherlands
    Posts
    29,748

    Default Re: Removable Storage Control/Auditing

    Nice it works!

    Tot je dienst. Dat van die dubbele is al lang vergeven en vergeten denk ik.
    Henk van Velden

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •