0

I am experimenting with securing diskless clients booting both RHEL 6.5 and Windows 7 via PXE (and iPXE in the future) from iSCSI targets. These computers run only on an internal network and are disconnected from the Internet so the only way for data to be taken without authorization would be for a user to bring in a hard drive, connect it, and transfer the data.

I know that I can mitigate this to some degree by disabling the SATA and USB ports in the BIOS and setting up a BIOS password. However, the BIOS settings can be reset via the jumper. The only option I can think of that could prevent this threat would be through the destruction of the ports themselves, perhaps through the use of something like super glue.

Do I have any other options, that would not cause physical damage, to prevent data from being transferred via a drive that someone brought in and connected?

Improve this question
3
  • Have you considered a hardware solution with a dedicated Thin/Zero Client? Typically you can configure the server and such hardware to not allow mounting of external storage.
    – zedman9991
    Dec 18, 2014 at 14:28
  • @zedman9991 I have, but this will be done, at least initially, on a small level with existing clients.
    – cmorris14
    Dec 18, 2014 at 14:46
  • Too late to be useful to the original author, but: - Have you considered the security of your solution? It would maybe not be that hard to spoof your carefully prepared hardware with a (virtual) machine that can be modified, copied, frozen, etc.
    – Toni Homedes i Saun
    Apr 15 at 8:53

1 Answer 1

Reset to default
1

For RHEL, you should be able to create a custom kernel with support for SATA/ATA and USB mass storage disabled. If the kernel won't recognize the devices, the user can't access them.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .