Results 1 to 9 of 9

Thread: non-networked, standalone machine - prevent user from copy files off of computer

  1. #1
    Join Date
    Mar 2013
    Beans
    4

    non-networked, standalone machine - prevent user from copy files off of computer

    hi there,
    i need to lock down a machine (running 12.04 LTS) so that guest users (who, for various reasons, will be logged in via a named standard account, not the "Guest" account) cannot copy any files off of the machine.

    LAN and wireless access will be turned off via disabling of said components via pwd-protected bios settings.

    i would like to prevent the users from plugging in a USB drive into the open ports and simply dragging and dropping files on to the USB stick. i know i can disable the individual USB ports via pwd-protected bios settings, but that still leaves the issue of needing 2 active USB ports for the keyboard and mouse to plug into. (i have already thought of shutting down all USB ports and using PS/2 keyboard/mouse, but i'd like to be able to use USB keyboard/mouse due to availability).

    so, my questions are:
    • any tips on how to allow use of USB keyboard/mouse but prevent use of USB drive/stick or any other USB-based device?
    • any other security holes that i should be aware of which would allow guest users to copy files off of the machine?


    thanks so much!

  2. #2
    Join Date
    Jan 2009
    Location
    ::1
    Beans
    2,461

    Smile Re: non-networked, standalone machine - prevent user from copy files off of computer

    When I plug in a USB-flash-stick, lsmod shows as extra modules:

    > nls_iso8859_1 12713 1
    > usb_storage 57199 1

    So, how about disabling (the loading of) usb_storage? Maybe block it in /etc/modprobe.d/blacklist, or just remove usb-storage.ko from your system,

    /lib/modules/3.8.0-13-generic/kernel/drivers/usb/storage/usb-storage.ko

    Or compile a kernel without usb_storage?

    EDIT: tested it:

    Unplug usb storage sticks.

    Then

    Code:
    sudo rmmod usb_storage
    sudo nano /etc/modprobe.d/blacklist.conf
    at the end, add:

    Code:
    blacklist usb_storage
    Save and exit.

    Now plug in a usb stick ... and see that it does NOT work ...
    Last edited by sanderj; March 19th, 2013 at 10:34 PM.

  3. #3
    Join Date
    Apr 2008
    Location
    LOCATION=/dev/random
    Beans
    5,767
    Distro
    Ubuntu Development Release

    Re: non-networked, standalone machine - prevent user from copy files off of computer

    I have tried this and it does work.

    It was quite some time ago so I can't remember the exact details but blacklisting the usb_storage module is definitely the way to go.

    Some other considerations...
    Make sure your machine doesn't have a CD-R or DVD-R drive.
    Is it feasable for a user to make a copy either by simply copying the data with a pen and paper or by taking a photograph?
    How physically secure is the machine? Could someone bypass your OS altogether by booting a live CD/USB or could they simply walk out with the hard drive in their pocket?

    As any good admin will tell you physical access = root access, the only method you can use to protect against the users having physical access is to use full disk encryption. Ideally your machine would be locked up tight in a secure cabinet, with only keyboard/mouse/monitor/power cables exiting the case.
    Cheesemill

  4. #4
    Join Date
    Mar 2013
    Beans
    4

    Re: non-networked, standalone machine - prevent user from copy files off of computer

    thanks fellas. i will try the usb_storage method right now.

  5. #5
    Join Date
    Mar 2013
    Beans
    4

    Re: non-networked, standalone machine - prevent user from copy files off of computer

    additional question re usb_storage:

    is there any way to only disable it for a certain user, or for non-admin users? i'd like to be able to log in as my administrator account and add files if necessary. thanks so much fellas!

  6. #6
    Join Date
    Jan 2009
    Location
    ::1
    Beans
    2,461

    Re: non-networked, standalone machine - prevent user from copy files off of computer

    Quote Originally Posted by SwanRonson View Post
    additional question re usb_storage:

    is there any way to only disable it for a certain user, or for non-admin users? i'd like to be able to log in as my administrator account and add files if necessary. thanks so much fellas!
    First tell us if the method described works for you ...

  7. #7
    Join Date
    Mar 2013
    Beans
    4

    Re: non-networked, standalone machine - prevent user from copy files off of computer

    Quote Originally Posted by sanderj View Post
    First tell us if the method described works for you ...
    you're right, i got ahead of myself.

    the usb_storage method didn't work for me. i'm guessing i'm doing something wrong?

    i did the sudo rmmod usb_storage

    and then when i open blacklist.conf, at the end it says:

    blacklist usb_storage

    is there anything else i should check? would it be helpful if i post a printout of lsmod?

  8. #8
    Join Date
    Jan 2012
    Location
    /a/
    Beans
    753
    Distro
    Kubuntu 13.04 Raring Ringtail

    Re: non-networked, standalone machine - prevent user from copy files off of computer

    Just a warning: while you can prevent users from copying files via USB, if they know any programming they could set certain files to be uploaded online once network is re-enabled, then have the script/program delete itself.
    The whole thing is so patently infantile, so foreign to reality, that to anyone with a friendly attitude to humanity it is painful to think that the great majority of mortals will never be able to rise above this view of life.
    ~Sigmund Freud

  9. #9
    Join Date
    Nov 2008
    Location
    Metro Boston
    Beans
    8,616
    Distro
    Kubuntu 14.04 Trusty Tahr

    Re: non-networked, standalone machine - prevent user from copy files off of computer

    Filling the USB ports with epoxy is another effective solution. I'm not joking, either. That's a pretty common practice in security conscious organizations. If you need to enable a mouse and keyboard, use wireless ones and mount the receiver with super glue and epoxy so it cannot be removed.
    Last edited by SeijiSensei; March 24th, 2013 at 04:37 AM.
    If you ask for help, please have the courtesy to check for responses and thank the people who helped you.

    Blog · Linode System Administration Guides · Android Apps for Ubuntu Users

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •