Blocks unkown usb stick which could be used to perform a rubber ducky attack
Install USBGuard by running the command “sudo apt install usbguardv
” in the terminal.
To configure USBGuard, open the configuration file located at /etc/usbguard/usbguard-daemon.conf
and make any necessary changes to the settings.
Start the USBGuard service by running the command “sudo systemctl start usbguard
“
To make USBGuard start automatically at boot, run the command “sudo systemctl enable usbguard
“
To view the current status of USBGuard, run the commands “sudo systemctl status usbguard
“
To create or modify rules for USB devices, use the command “sudo usbguard generate-policy > /etc/usbguard/rules.conf
“
To reload the rules without restarting the service use “sudo usbguard reload-policy
“
To check the USB devices connected and its current status, use “sudo usbguard list-devices
“
Note: The above steps are the basic steps to use USBGuard on Ubuntu 22.04. It's recommended to read the official documentation for more detailed instructions.
sudo systemctl start usbguard
sudo usbguard list-rules
How can I allow current usb devices?
To allow all currently connected USB devices using USBGuard, you can use the usbguard allow-device command with the --present
option. This will create a rule that allows any USB device that is currently connected to the computer.
For example, to allow all currently connected USB devices, you can run the following command:
sudo usbguard allow-device --present
This will create a rule that allows all currently connected USB devices, and any future devices that match the same criteria.
You can also specify additional criteria to restrict the rule to a specific subset of devices. For example, you can allow only USB devices with a specific vendor or product ID by using the --vendor-id
and --product-id
options.
sudo usbguard allow-device --present --vendor-id 0x1234 --product-id 0x5678
This will create a rule that allows any currently connected USB device with the vendor ID 0x1234 and the product ID 0x5678. You can find the vendor and product IDs for a specific device by running the lsusb command and looking for the idVendor and idProduct fields in the output.
You can use the usbguard list-rules command to view the current set of rules and verify that the rule you created has been added.
sudo usbguard list-rules
Keep in mind that the allow-device command creates a permanent rule that will remain in effect even after the device is disconnected. If you want to allow a device temporarily and have the rule automatically expire when the device is disconnected, you can use the usbguard temporary-allow command instead.
sudo usbguard temporary-allow --vendor-id 0x1234 --product-id 0x5678
This will create a temporary rule that allows the specified device for a default duration of 5 minutes. You can use the —duration option to specify a different duration in seconds.
sudo usbguard temporary-allow --vendor-id 0x1234 --product-id 0x5678 --duration 600
This will create a temporary rule that allows the specified device for a duration of 10 minutes (600 seconds).
How can I deny all devices?
To deny all USB devices using USBGuard, you can use the usbguard insert-rule command with the —rule deny option. This will create a rule that denies all USB devices by default.
For example, to deny all USB devices, you can run the following command:
sudo usbguard insert-rule --rule deny
This will create a rule at the top of the rule list that denies all USB devices. Any devices that are currently connected will be disconnected, and any future devices that are connected will be denied automatically.
You can use the usbguard list-rules command to view the current set of rules and verify that the rule you created has been added.
Copy code
sudo usbguard list-rules
Keep in mind that the insert-rule command creates a permanent rule that will remain in effect even after the devices are disconnected. If you want to deny a device temporarily and have the rule automatically expire when the device is disconnected, you can use the usbguard temporary-deny command instead.
sudo usbguard temporary-deny
This will create a temporary rule that denies all USB devices for a default duration of 5 minutes. You can use the —duration option to specify a different duration in seconds.
sudo usbguard temporary-deny —duration 600
This will create a temporary rule that denies all USB devices for a duration of 10 minutes (600 seconds).
Note that the temporary-deny command will not affect devices that are already connected. To disconnect a device that is currently connected, you can use the usbguard remove-device command.
sudo usbguard remove-device <device-id>
Replace <device-id>
with the ID of the device that you want to disconnect. You can use the usbguard list-devices command to view the list of currently connected devices and their IDs.
sudo usbguard list-devices
how to revoke all granted permissions
To revoke all granted permissions for USB devices using USBGuard, you can use the usbguard delete-rule
command with the --rule
allow option. This will delete all rules that allow access to USB devices.
For example, to revoke all granted permissions for USB devices, you can run the following command:
sudo usbguard delete-rule --rule allow
This will delete all rules in the rule list that allow access to USB devices. Any devices that are currently connected and were granted access by a deleted rule will be disconnected, and any future devices that match the deleted rules will be denied automatically.
You can use the usbguard list-rules command to view the current set of rules and verify that the rules you want to delete have been removed.
sudo usbguard list-rules
Keep in mind that the delete-rule command only affects permanent rules that were created using the usbguard insert-rule or usbguard allow-device commands. Temporary rules that were created using the usbguard temporary-allow command will expire automatically after the specified duration, and do not need to be deleted manually.
If you want to revoke all temporary permissions for USB devices, you can use the usbguard delete-temporary-rules command.
sudo usbguard delete-temporary-rules
This will delete all temporary rules in the rule list that allow access to USB devices. Any devices that were granted access by a deleted temporary rule will be disconnected.
Note that the delete-rule and delete-temporary-rules commands do not affect rules that deny access to USB devices. If you want to revoke all denied permissions as well, you can use the usbguard delete-rule command with the —rule deny option to delete all rules that deny access to USB devices.
sudo usbguard delete-rule --rule deny
This will delete all rules in the rule list that deny access to USB devices. Any devices that were denied access by a deleted rule will be disconnected, and any future devices will be allowed automatically.
do I need to reload the systemd daemon for those changes to take effect?
After making changes to the USBGuard rules, you do not need to reload the systemd daemon in order for the changes to take effect. The changes will be applied automatically by the USBGuard service.
You can use the systemctl command to check the status of the USBGuard service and verify that it is running.
systemctl status usbguard
If the USBGuard service is not running, you can start it by running the following command:
sudo systemctl start usbguard
You can also use the usbguard command-line utility to view the current set of rules and verify that the changes you made have been applied.
sudo usbguard list-rules
If you made changes to the rules but they are not being applied as expected, you may need to check the USBGuard logs to troubleshoot the issue. You can view the USBGuard logs by running the following command:
sudo journalctl -u usbguard
This will display the logs for the USBGuard service, which may contain information about any errors or issues that are preventing the changes from being applied.
source: https://infosec-handbook.eu/blog/tool-usbguard/
The link above is dead/defunct, but the wayback machine has us covered ;)
https://web.archive.org/web/20210216143433/https://infosec-handbook.eu/blog/tool-usbguard/