Consider installing #USBGuard on your #notebook (and other #Linux devices with #USB ports that will leave your office).

It helps protect them against unknown USB devices, by not allowing them to be used without your approval (temporary or permanent).

It may also be helpful with mouse jigglers that were plugged into your desktop PC, to keep your screen lock from kicking in.

Caveats:

1) After installation, use generate-policy to create an initial configuration, as per the instructions, before enabling and starting the service.

2) It is probably a good idea to plug in a spare keyboard and a spare mouse, and run an allow-device -p for them. Hardware may fail.

3) Not all USB devices provide a serial number that uniquely identifies them. By default, USBGuard associates allowed devices lacking a serial number with the exact port they're plugged in: plug them in elsewhere, and they can't be used.

While you can bypass this initially during generate-policy via its -Pswitch, the allow-device sub-command does not have any such option.

BIOS upgrades or CMOS battery failures may change the port numbering of a device – locking you out of using your keyboard or mouse. Or worse: out of internal USB devices that are no longer permitted to work.

Either learn how to chroot, using a fairly recent image of your distro on a bootable stick (read up on #Ventoy), so you can fix this manually, if it happens.

Or remove said port associations from all rules via:

sudo sed -i 's/ via-port "\([^"]*\)"//g' /etc/usbguard/rules.conf

https://usbguard.github.io/

Protecting yourself against BadUSB Attack(USBGuard)

https://tube.tchncs.de/videos/watch/1a1cc8db-1048-4d7c-aeba-509057861497

Recommended #opensource #USB #protection for #DigitalSelfDefense against #BadUSB on #Linux: #USBGuard

Why? - Block unknown USB devices from #PlugAndPlay · Allow devices temporarily or permanently · Caveats: 1) Does not protect against allowed USB devices with (secretly) re-programmed #firmware, #KillUSB or #JuiceJacking. 2) Remember to permanently allow all devices that are currently connected, during installation.

https://usbguard.github.io/

More recommendations: https://tuxwise.net/recommended-software/

I just finished configuring #USBGuard.
It's awesome, and gives me #security against physical risks (such as someone plugging an infected USB disk into my computer).

https://wiki.archlinux.org/title/USBGuard

Hat wer Erfahrung mit USBGuard unter Linux ?

#usbguard #Linux #folllowerpower #askthefedi