In this lab, we’ll be setting up USBGuard to to control which USB devices are allowd to communicate with our hosts once they are plugged in. USB devices are an easy way for attackers to gain a foothold in our environments via USB Dropper attacks. USBGuard is a great security control that can help us avoid being infected by a malicious USB device.
*This course is not approved or sponsored by Red Hat.*
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- Install and Configure USBGuard with Basic Settings
Install USBGuard
[root@host]# yum install -y usbguardStart the USBGuard service
[root@host]# systemctl start usbguard.serviceGenerate a base policy for USBGuard
[root@host]# usbguard generate-policy > /etc/usbguard/rules.confRestart the USBGuard service after creating the base policy
[root@host]# systemctl restart usbguard.serviceEnable the USBGuard service to start at boot
[root@host]# systemctl enable usbguard.service
- Configure USBGuard Permissions
Create a group named
USBGuard-Users[root@host]# groupadd USBGuard-UsersAdd
cloud_userto theUSBGuard-Usersgroup[root@host]# usermod -a -G USBGuard-Users cloud_userVerify group membership:
[root@host]# cat /etc/group | grep USBGuard-Users
Update USBGuard to permit the
USBGuard-Usersgroup to make changes to USBGuard[root@host]# nano /etc/usbguard/usbguard-daemon.confChange the
IPCAllowedGroupsline to read:IPCAllowedGroups=USBGuard-UsersRestart the USBGuard service
[root@host]# systemctl restart usbguard.service
