While the question of completely disabling usb-controllers and -storage to defeat an evil-maid-attack has already been answered here quite often, I have a different solution in mind.

Upon locking the GUI, the system would

  • iterate over the already connected usb devices,
  • lock all other ports, and
  • while being locked check the connected devices

If a device is removed from the system, a specific action is taken like locking all usb-ports or powering down the system. This would obviously not prevent a skilled attack, but would prevent the literal evil-maid (technically unversatile person with physical access, which has been instructed to "just plug this thing between keyboard and computer").

Anyone knows if a script doing that already exists?

Sidenote: Yes I know of Law 3, that this does not provide complete security, yadayada. Still, a good line of defense means to have several moving parts and having this script would increase the physical security in environments, where you are unable to do more (yes those exist).

closed as off-topic by Xander, Jedi, Steve, Teun Vink, Bacon Brad Jul 7 '17 at 21:40

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.