Disable Kernel Support for USB via Bootloader Configuration

Documentos > Datadog Security > OOTB Rules > Disable Kernel Support for USB via Bootloader Configuration

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Description

All USB support can be disabled by adding the nousb argument to the kernel’s boot loader configuration. To do so, append “nousb” to the kernel line in /etc/default/grub as shown:

kernel /vmlinuz-VERSION ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet nousb

Rationale

Disabling the USB subsystem within the Linux kernel at system boot will protect against potentially malicious USB devices, although it is only practical in specialized systems.

Warning

Disabling all kernel support for USB will cause problems for systems with USB-based keyboards, mice, or printers. This configuration is infeasible for systems which require USB devices, which is common.