Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
57

You can disable USB storage on Linux by blacklisting the module. modprobe -r usb-storage echo blacklist usb-storage >> /etc/modprobe.d/10-usbstorage-blacklist.conf echo blacklist uas >> /etc/modprobe.d/10-usbstorage-blacklist.conf If your users have physical access to the machine, and knows the encryption keys, the game is up no matter what ...


20

Client-server architecture This is another approach that could make copying files much harder, but it requires investing more effort from your side. Access to the information could be setup on a client-server architecture basis with information being stored in a database (such as MySQL or PostgreSQL) on a remote server in a secure location. Then, provide ...


20

In addition to blocking USB (see other answers above): Disable networking, because... ... otherwise user will use remote access to your machine, e.g. via scp or ftp, and copy files from your machine. ... otherwise logged in users will be able to transfer file via net from your machine to some other machine via scp, ftp, samba, http.


13

OK, I'm totally not a security expert and maybe this is completely off the mark (let me know in the comments!), but... If you can secure the box physically (otherwise all bets are off), then maybe you can let the user log on only with user A. All the sensitive files however would belong to user B and inaccessible to user A. EXCEPT for one program "PDF ...


8

VNC Your files could be stored on a computer in a secure location. Setup a VNC server on it and disable file transfer capability. Per this question on ServerFault it can be done in TightVNC. Ensure no other ports are open on the computer that stores your files. Provide a VNC client station and lock it down by: disabling I/O ports in the OS and on the ...


3

If you just want to disable all usb devices, have a look at usb-storage.ko (USB Mass Storage driver under Linux). Disabling the driver would affect all usb devices, keyboards/mice included. To disable the driver, you could blacklist it by modifying /etc/modprobe.d/blacklist.conf. Just add the line: blacklist usb-storage This solution assumes other users ...


2

How about something like a human bottleneck via procedure instead of automation and access to all files at once? All of the proposed solutions propose making the computer restrict access. This suffers from the problem that computers are ultimately stupid at the lowest level, and do what they're told. Since the HD is using whole disk encryption, all files ...


2

Following the principle of "only gives one the rights needed to achieve his task", maybe you can implement a restricted shell that will enforce that users of your system only do what you allow them to do. If your users are not able to: scp mount launch any network utility (firefox, netcat, curl) Use bash builtins to open network stream. Then the only way ...


1

I don't consider myself an expert of S3, but I think the first option makes more sense for several reasons. The most important one is that a developer will inevitably set the wrong ACL at some point and allow public access. Not out of malice, not out of laziness, but out of ignorance (e.g. what is the developer turnover on your company?, because that is how ...


Only top voted, non community-wiki answers of a minimum length are eligible