I am experimenting with securing diskless clients booting both RHEL 6.5 and Windows 7 via PXE (and iPXE in the future) from iSCSI targets. These computers run only on an internal network and are disconnected from the Internet so the only way for data to be taken without authorization would be for a user to bring in a hard drive, connect it, and transfer the data.

I know that I can mitigate this to some degree by disabling the SATA and USB ports in the BIOS and setting up a BIOS password. However, the BIOS settings can be reset via the jumper. The only option I can think of that could prevent this threat would be through the destruction of the ports themselves, perhaps through the use of something like super glue.

Do I have any other options, that would not cause physical damage, to prevent data from being transferred via a drive that someone brought in and connected?

  • Have you considered a hardware solution with a dedicated Thin/Zero Client? Typically you can configure the server and such hardware to not allow mounting of external storage. – zedman9991 Dec 18 '14 at 14:28
  • @zedman9991 I have, but this will be done, at least initially, on a small level with existing clients. – cmorris14 Dec 18 '14 at 14:46

For RHEL, you should be able to create a custom kernel with support for SATA/ATA and USB mass storage disabled. If the kernel won't recognize the devices, the user can't access them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.