2 Replies Latest reply: Jun 28, 2011 10:33 AM by 867900 RSS

    Allow some USB devices but not others

      Hello all,
      We have a need to allow some USB devices (CD/DVD Readers) but not others (Thumb Drives, other External drives). I see that I can globally disable all of it with utdevadm, but I don't see a way to have more granular control. Has anyone done this sort of thing before? I'm using Red Hat Enterprise Linux 5 for the server if that makes a difference.

        • 1. Re: Allow some USB devices but not others
          If your sending your devices via -r usb:on, then I would implement some policy on the windows device, that's how we do it (no allowed devices just can't install their device). For WTS 2008 R2 we don't use -r usb:on, so I'm currently looking into ways in the script utdevadm to do something like a filter. Much nicer would be, Oracle would deliver some filter as they do in Virtual Box for srss 5.3 ?.

          regards, thomas
          • 2. Re: Allow some USB devices but not others
            Yeah, stopping it at the Windows server (a citrix box in this case) is our fallback plan. I was just hoping to stop it one rung closer to the user. We are a high security sort of place so the less things work the better! Right now I'm poking into Linux modules to see if I can strip out most of the usb_storage drivers. We'll see how that goes.