Removable Storage Control/Auditing

English Hardware
#1

Hi all,
I’m looking for a product that will allow me to lockout USB removable storage on a Suse workstation, or to log all data copied to/from the device.
Does anyone know of such a product?

Thanks for any replies.

Cheers,
Chris

#2

What about blacklisting the usb_storage module of he kernel? Or is that a bit to drastic.

Edit: this came in a flash to my mind, I did not try this, but I think it will work.

#3

Thanks Henk, I’m not an expert but I found this link. Is it what you had in mind?
Linux Disable USB Devices (Disable loading of USB Storage Driver)

Chris

#4

Please do not double post!

#5

First I hope you saw the complaints about you posting the same in more then one thread. That will really make a mess out of the discussion. Better not quite oin the correct forum then everywhere :wink:

Maybe a mod can remove or block the other one.

I read your link and it seems that it starts from the same assumption as I did. Though I am not sure that the implementation there would work in openSUSE. See e.g. the difference between he mentioning usb-storage and I mentioning usb_storage. Mine is from an *lsmod *on my (10.3) system.

I thougt there was a place in YaST where you could blacklist modules, but I can not find it.

IMHO you should not edit /etc/modprobe.conf, but /etc/modprobe.conf.local.

I do have /lib/modules/$(uname -r)/kernel/drivers/usb/storage/usb-storage.ko, so you could go for this solution. (see the - and not the _ in this name, maybe the module has the _ and the file the -)

In any case write down what you did, so you can reverse easily (and make backup copies of files you ar going to edit). Do one test at the time. As this is rather easy to test I have no doubt you will find out if things function as you wish them.

Maybe one of the gurus here comes up with the ideal way to do this in openSUSE, but there are always many way to do things in Unix/Linux.

#6

Thanks Henk, I’ll give it a go and test the results.

Cheers,
Chris

#7

FYI Henk it worked perfectly
Hartstikke bedankt voor je help, nogmaals excuses voor de multiple posts. Het zou niet weer gebeuren :wink:

#8

Nice it works!

Tot je dienst. Dat van die dubbele is al lang vergeven en vergeten denk ik.