≡ Menu

Linux Disable USB Devices (Disable loading of USB Storage Driver)

In our research lab, would like to disable all USB devices connected to our HP Red Hat Linux based workstations. I would like to disable USB flash or hard drives, which users can use with physical access to a system to quickly copy sensitive data from it. How do I disable USB device support under CentOS Linux, RHEL version 5.x/6.x/7.x and Fedora latest version?

The USB storage drive automatically detects USB flash or hard drives. You can quickly force and disable USB storage devices under any Linux distribution. The modprobe program used for automatic kernel module loading. It can be configured not load the USB storage driver upon demand. This will prevent the modprobe program from loading the usb-storage module, but will not prevent root (or another privileged program) from using the insmod/modprobe program to load the module manually. USB sticks containing harmful malware may be used to steal your personal data. It is not uncommon for USB sticks to be used to carry and transmit destructive malware and viruses to computers. The attacker can target MS-Windows, macOS (OS X), Android and Linux based system.

usb-storage driver

The usb-storage.ko is the USB Mass Storage driver for Linux operating system. You can see the file typing the following command:
# ls -l /lib/modules/$(uname -r)/kernel/drivers/usb/storage/usb-storage.ko
All you have to do is disable or remove the usb-storage.ko driver to restrict to use USB devices on Linux such as:

  1. USB keyboards
  2. USB mice
  3. USB pen drive
  4. USB hard disk
  5. Other USB block storage

How to forbid to use USB-storage devices on using fake install method

Type the following command under CentOS or RHEL 5.x or older:
# echo 'install usb-storage : ' >> /etc/modprobe.conf
Please note that you can use : a shell builtin or /bin/true.
Type the following command under CentOS or RHEL 6.x/7.x or newer (including the latest version of Fedora):
# echo 'install usb-storage /bin/true' >> disable-usb-storage.conf
Save and close the file. Now the driver will not load. You can also remove USB Storage driver without rebooting the system, enter:
# modprobe -r usb-storage
# mv -v /lib/modules/$(uname -r)/kernel/drivers/usb/storage/usb-storage.ko /root/
##################
#### verify it ###
##################
# modinfo usb-storage
# lsmod | grep -i usb-storage
# lsscsi -H

Sample outputs:

Fig.01: How to disable USB mass storage devices on physical Linux system?

Fig.01: How to disable USB mass storage devices on physical Linux system?

Blacklist usb-storage

Edit /etc/modprobe.d/blacklist.conf, enter:
# vi /etc/modprobe.d/blacklist.conf
Edit or append as follows:

blacklist usb-storage

Save and close the file.

BIOS option

You can also disable USB from system BIOS configuration option. Make sure BIOS is password protected. This is recommended option so that nobody can boot it from USB.

Encrypt hard disk

Linux supports the various cryptographic techniques to protect a hard disk, directory, and partition. See "Linux Hard Disk Encryption With LUKS [ cryptsetup Command ]" for more info.

Grub option

You can get rid of all USB devices by disabling kernel support for USB via GRUB. Open grub.conf or menu.lst and append "nousb" to the kernel line as follows (taken from RHEL 5.x):

kernel /vmlinuz-2.6.18-128.1.1.el5 ro root=LABEL=/ console=tty0 console=ttyS1,19200n8 nousb

Make sure you remove any other reference to usb-storage in the grub or grub2 config files. Save and close the file. Once done just reboot the system:
# reboot
For grub2 use /etc/default/grub config file under Fedora / Debian / Ubuntu / RHEL / CentOS Linux. I strongly suggest that you read RHEL/CentOS grub2 config and Ubuntu/Debian grub2 config help pages.

Sysadmin because even developers need heroes!!!

Share this tutorial on:
{ 34 comments… add one }
  • Humberto Massa March 16, 2009, 4:24 pm

    Someone with physical access to the computer can still easily transfer the “sensitive” files to another computer or enable the USB by using a bootable media. I would not bother with “protection” that does not protect.

  • Liju March 17, 2009, 10:14 am

    I am using the same method to deny the access

    Edit /etc/modprobe.conf
    and added the entry
    install usb_storage wall “Critical device malfunction! Drive will be formatted”
    Save it

  • The Doctor April 25, 2009, 2:04 am

    @Humberto Massa:
    “…by using a bootable media” which is then secured against via disabling BIOS Boot Order (Floppy/USB/CD, then HDD, etc.)+BIOS password. One could maintain the USB bridge active, however.

    It’s accepted fact the majority of data theft occurs fr in-house, disgruntled employees. This HOW-TO keeps USB abilities for admins, but locks out users.

    Troll attempt fail. Go back to 4chan.

  • hasan mubarak naqvi June 2, 2009, 9:56 am

    Can any one tell me how to get out of it means, I was able to disable the driver using the second option :

    You can also remove USB Storage driver, enter:
    # ls /lib/modules/$(uname -r)/kernel/drivers/usb/storage/usb-storage.ko
    # mv /lib/modules/$(uname -r)/kernel/drivers/usb/storage/usb-storage.ko /root

    But now I do not know how to enable it back

    • nixCraft June 2, 2009, 10:55 am

      Copy back driver and load drive into system:

      mv /root/usb-storage.ko  /lib/modules/$(uname -r)/kernel/drivers/usb/storage/
      modprobe usb-storage
      • chinmay July 15, 2011, 6:46 am

        I am using this command but Usb not blocking & when i put the pen drive is laptop showing the all files & folders.

        what i will do ?

  • Mohanraj Subramaniam August 14, 2009, 12:51 pm

    insert the module by using insmod command.

    insmod /lib/modules/$(uname -r)/kernel/drivers/usb/storage/
    modprobe usb-storage.ko

  • hasan mubarak naqvi August 15, 2009, 11:26 am

    Thanks Mohan,
    I will definitely try that out and let u know …..

    Thanks alot again for the help.

  • ragesh December 8, 2009, 6:07 am

    dear sir,
    how to disable pendrive in domain user ? please give me replay

  • Live July 26, 2010, 1:59 am

    This works great!

  • Live July 27, 2010, 1:33 pm

    This only works but after I restart my Lucid Lynx, the USB device storage is mounted again on the desktop.

    I’ve already tried.

    sudo gedit /etc/rc.local/

    sudo rmmod usb_storage
    sudo modprobe -r usb_storage

    echo ‘install usb-storage : ‘ >> /etc/modprobe.conf

    ls /lib/modules/$(uname -r)/kernel/drivers/usb/storage/usb-storage.ko
    mv /lib/modules/$(uname -r)/kernel/drivers/usb/storage/usb-storage.ko /root

    How do I really unmount it?

    Nothing works for me!!!

  • JAS August 15, 2010, 7:11 am

    what OS & version is yours?

    if ubuntu only what you have to do is:

    ls /lib/modules/$(uname -r)/kernel/drivers/usb/storage/usb-storage.ko
    mv /lib/modules/$(uname -r)/kernel/drivers/usb/storage/usb-storage.ko /root

    reboot

    after that you may check “dmsg” for any bugs accruing

  • Live October 21, 2010, 7:45 am

    Hi JAS, yes I’ve tried what you said, to REBOOT, but try this:

    *assuming you’ve already DISABLED USB Storage Device AutoMount in Lucid Lynx*

    1. Turn OFF computer
    2. Insert any USB Storage Device
    3. Turn ON computer & boot to your desktop
    4. Wala! USB Storage Device is alive & kicking in there!

  • Live October 21, 2010, 10:27 am

    Nevermind, I solved it by:

    sudo gconf-editor

    Uncheck & Set As Default:

    apps>nautilus>preferences>media_automount

    Thanks. :)

  • Live October 24, 2010, 12:27 pm

    After sometime, none of this still worked for me, I tried to mount a Seagate USB external Hard Disk, and somehow it MOUNTED!

    Ubuntu, what a shame.

    So I though of a quick and dirty fix.

    sudo chmod 000 /media

    Try to mount your media you suckers. I kid, I kid.

    • vimal September 3, 2012, 5:52 am

      thanks… your command is very helpfull me

    • pankaj January 13, 2015, 10:54 am

      thanks

  • Live October 24, 2010, 3:56 pm

    So I guess, it’s a little TOO Extreme to 000 /media entirely.

    Finally, after reading a lot of tutorials and howto’s. vivitek can you update your post. Really, this tutorial doesn’t work for me.

    As it turns out, try leaving your usb device storage in your computer port and reboot, see that it will automount even though you’ve removed usb-storage.ko.

    After further investigation, I found out the reason why, when I boot, I noticed usb_storage module is still Loaded, dunno, where the kernel gets it from, since I already removed it as stated in this tutorial.

    Check it for yourself:

    lsmod | grep usb

    So I just inserted rmmod usb_storage in the /rc.local of my Ubuntu so it doesn’t get a module upon insertion, of course, remove also the usb-storage.ko from your kernel, beware, upon kernel NEW INSTALL, it will be back there again. So lock your kernel versions!

    Whew.

    Hope this is my final solution. Thanks.

    • Priyanka February 21, 2014, 10:15 am

      Hey thanks.. it works for me !!

  • Nima December 17, 2010, 10:11 pm

    thanks! but i cant disable usb storage with this way! i use debian, please help me! :-s

    mv …. dont work!

  • Ganesh January 25, 2011, 3:06 pm

    sorry……
    by just moving /lib/modules/2.6.18-164.el5/kernel/drivers/usb/storage/usb-storage.ko to /root doesnt work…..
    i think there is something more to do……..
    pls do rply if anyone has a sugession……..

  • Ganesh January 25, 2011, 6:04 pm

    ah… alas i found some simple way to get through…
    For disabling using cmd——————————————
    jst move the modules to some other location other than the default..
    #mv /lib/modules/2.6.18-164.el5/kernel/drivers/usb/storage/usb-storage.ko /root(or to any other place)
    this is for mass storage blocking….
    for blocking other usb connections like netsetter etc use the cmd below
    #mv /lib/modules/2.6.18-164.el5/kernel/drivers/usb/serial/usbserial.ko /root
    2.6.18-164.el5 is my kernal version.. u could view ur version by #uname -r
    For enabling—– do he revrse! bring the file back
    #mv /root/usb-storage.ko /lib/modules/2.6.18-164.el5/kernel/drivers/usb/storage/usb-storage.ko
    #mv /root/usbserial.ko /lib/modules/2.6.18-164.el5/kernel/drivers/usb/serial/usbserial.ko
    After that type #modprobe -a usbserial
    #modprobe -a usb_storage
    ————————SIMPLEST WAY IS TO BLOCK in GRUB——————————
    Open the /etc/grub.conf and edit the kernal line and insert ‘nousb’
    kernel /boot/vmlinuz-2.6.18-164.el5 ro root=LABEL=/ nousb rhgb quiet
    #reboot
    and U’r done……….
    wen u need to enable just edit and remove ‘nousb’ and reboot
    ———————————ThankYou————————————————————–

    • ArunMohan January 31, 2011, 10:31 am

      Hey Ganesh, thanks.. Its working.. I think u have vast knowledge in linux. I would like to know more about linux.. how can i contact u??

      • Ganesh January 31, 2011, 11:58 am

        thnk u arun…..
        do keep in touch…. post your doubts here……
        we’l do the bst to slve them…….

  • dennis February 21, 2011, 2:50 am

    hi, guys.

    to remove the driver, move it
    # mv /lib/modules/$(uname -r)/kernel/drivers/usb/storage/usb-storage.ko /root

    and update the initramfs
    # update-initramfs -k all -c -v

    after updating initramfs , surelly it will not reapear.

    reboot

  • Burim Shala March 2, 2011, 9:13 am

    Worked for me using Grub Method ,it worked perfectly and i think it disabled also the USB Power ,cuz im not seeing Led’s lighted in my keyboard.

  • shweta April 14, 2011, 4:51 pm

    hey, i m using fedora & i want to block all the USB’s & give access to a particular usb device..
    I tried changin kernel entries using grub command but it is completely blocking all the usbs
    can anyone help me?

    • Amar February 16, 2012, 6:35 am

      #block only local user not a root
      sudo chmod 700 /media

      • Josir May 2, 2013, 4:38 pm

        Best and more elegant solution of all.

  • razvi September 19, 2011, 3:01 am

    thnk u dennis

  • rupam September 27, 2011, 11:05 am

    i tried mv command to disable the usb.it worked but when i try to enable it using modprobe usb-storage or insmod command it fails.gives me warning with the previous as depreciated config file /etc/modprobe.conf ,all config files belong in /etc/modprobe.d
    what to do?plz help me.its urgent

  • darrell February 10, 2012, 7:56 am

    None of these work, is there no proper site for Linux commands

  • Abdul Majid Mohammed January 15, 2014, 7:46 am

    I dont have that modprobe.conf file in my etc folder.

    [abdmajid@oc2382561007 ~]$ ls /etc/ | grep -i modprobe
    modprobe.d
    [abdmajid@oc2382561007 ~]$ ls /etc/modprobe.d/
    blacklist.conf disable-ipv6.conf dist-oss.conf iwlagn.conf
    blacklist-kvm.conf dist-alsa.conf ibm-sound.conf iwlwifi.conf
    blacklist-toshiba_acpi.conf dist.conf iwl3945.conf

  • Hardened Criminal May 11, 2015, 1:18 am

    nousb in Grub is great except when the server has a usb keyboard like Dell’s.

Security: Are you a robot or human?

Leave a Comment

You can use these HTML tags and attributes: <strong> <em> <pre> <code> <a href="" title="">


   Tagged with: , , , , , , , , , , , , , , ,