{"id":1439,"date":"2016-10-08T02:38:50","date_gmt":"2016-10-07T17:38:50","guid":{"rendered":"http:\/\/matoken.org\/blog\/?p=1439"},"modified":"2016-10-08T02:38:50","modified_gmt":"2016-10-07T17:38:50","slug":"try-usbguard-to-protect-the-pc-from-unauthorized-usb-device","status":"publish","type":"post","link":"https:\/\/matoken.org\/blog\/2016\/10\/08\/try-usbguard-to-protect-the-pc-from-unauthorized-usb-device\/","title":{"rendered":"\u4e0d\u6b63\u306aUSB\u30c7\u30d0\u30a4\u30b9\u304b\u3089PC\u3092\u5b88\u308bUSBGuard\u3092\u8a66\u3059"},"content":{"rendered":"<p>BadUSB\u306a\u3069\u306e\u4e0d\u6b63\u306aUSB\u30c7\u30d0\u30a4\u30b9\u304b\u3089PC\u304c\u5b88\u308c\u306a\u3044\u304b\u306a\u3061\u3087\u3063\u3068\u8a2d\u5b9a\u3059\u308c\u3070\u3067\u304d\u305d\u3046?\u305d\u3082\u305d\u3082\u4f5c\u3063\u3066\u3044\u308b\u4eba\u304c\u3044\u308b\u3093\u3058\u3083?\u3068\u3044\u3046\u3053\u3068\u3067\u63a2\u3057\u305f\u3089USBGuard\u3068\u3044\u3046\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u3092\u898b\u3064\u3051\u307e\u3057\u305f\uff0e<\/p>\n<ul>\n<li><a href=\"https:\/\/dkopecek.github.io\/usbguard\/\">home | USBGuard<\/a><\/li>\n<\/ul>\n<p>\u3053\u306e\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u3092\u5c0e\u5165\u3057\u3066\u304a\u304f\u3068\uff0c\u8a2d\u5b9a\u3057\u305f\u30eb\u30fc\u30eb\u306b\u5408\u81f4\u3057\u306a\u3044USB\u30c7\u30d0\u30a4\u30b9\u306fblock\u3055\u308c\u307e\u3059\uff0e \u30c7\u30b9\u30af\u30c8\u30c3\u30d7\u5229\u7528\u306e\u5834\u5408\u306fGUI\u306e\u30a2\u30d7\u30ec\u30c3\u30c8\u3092\u5229\u7528\u3057\u3066USB\u63a5\u7d9a\u6642\u306b\u30a6\u30a3\u30f3\u30c9\u30a6\u304c\u30dd\u30c3\u30d7\u30a2\u30c3\u30d7\u3057\u3066\u63a5\u7d9a\u3059\u308b\u304b\u9078\u3079\u305f\u308a\u3082\u3057\u307e\u3059\uff0e \u4fbf\u5229\uff0e<br \/>\n\uff03USB KILLER\u306f\u2026\u2026USB\u914d\u7dda\u3092\u5916\u3057\u305f\u308aUSB\u30b3\u30cd\u30af\u30bf\u3092\u585e\u3050\u3057\u304b\u306a\u3044\u3067\u3059\u3088\u306d\u591a\u5206\uff0e<\/p>\n<h2 id=\"\u5c0e\u5165\">\u5c0e\u5165<\/h2>\n<p>Debian\/Ubuntu\u306b\u306f\u30d1\u30c3\u30b1\u30fc\u30b8\u304c\u3042\u308b\u306e\u3067\u305d\u3061\u3089\u304b\u3089\u5c0e\u5165\u3057\u307e\u3059\uff0e<\/p>\n<pre><code>$ sudo apt install usbguard usbguard-applet-qt<\/code><\/pre>\n<h2 id=\"\u8a2d\u5b9a\">\u8a2d\u5b9a<\/h2>\n<p>\u4e00\u822c\u30e6\u30fc\u30b6\u304b\u3089\u5229\u7528\u3059\u308b\u5834\u5408\u306f\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u3092\u7de8\u96c6\u3057\u3066\u30e6\u30fc\u30b6\u304b\u30b0\u30eb\u30fc\u30d7\u3092\u8ffd\u52a0\u3057\u3066\u30c7\u30fc\u30e2\u30f3\u306e\u518d\u8d77\u52d5\u3092\u884c\u3044\u307e\u3059\uff0e \u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u306f<em>\/etc\/usbguard\/usbguard-daemon.conf<\/em>\u3067\u3059\uff0e<\/p>\n<pre><code>diff --git a\/usbguard\/usbguard-daemon.conf b\/usbguard\/usbguard-daemon.conf\r\nindex 4a54ca0..7b3a165 100644\r\n--- a\/usbguard\/usbguard-daemon.conf\r\n+++ b\/usbguard\/usbguard-daemon.conf\r\n@@ -65,7 +65,7 @@ PresentControllerPolicy=keep\r\n#\r\n# IPCAllowedUsers=username1 username2 ...\r\n#\r\n-IPCAllowedUsers=root\r\n+IPCAllowedUsers=root user1 user2\r\n\r\n#\r\n# Groups allowed to use the IPC interface.\r\n@@ -75,7 +75,7 @@ IPCAllowedUsers=root\r\n#\r\n# IPCAllowedGroups=groupname1 groupname2 ...\r\n#\r\n-IPCAllowedGroups=root\r\n+IPCAllowedGroups=root users\r\n\r\n#\r\n# Generate device specific rules including the &quot;via-port&quot;<\/code><\/pre>\n<p>\u30e6\u30fc\u30b6\u306e\u5834\u5408\u306f<em>IPCAllowedUsers<\/em>\uff0c\u30b0\u30eb\u30fc\u30d7\u306e\u5834\u5408\u306f<em>IPCAllowedGroups<\/em>\u306b\u30b9\u30da\u30fc\u30b9\u533a\u5207\u308a\u3067\u66f8\u3044\u3066\u3044\u304d\u307e\u3059\uff0e<\/p>\n<h2 id=\"\u30c7\u30fc\u30e2\u30f3\u306e\u518d\u8d77\u52d5\">\u30c7\u30fc\u30e2\u30f3\u306e\u518d\u8d77\u52d5<\/h2>\n<p>\u8a2d\u5b9a\u3092\u53cd\u6620\u3059\u308b\u305f\u3081\u306b\u30c7\u30fc\u30e2\u30f3\u3092\u518d\u8d77\u52d5\u3057\u307e\u3059\uff0e<\/p>\n<pre><code>$ sudo service usbguard restart<\/code><\/pre>\n<h2 id=\"cui\u3067\u306e\u5229\u7528\u4f8b\">CUI\u3067\u306e\u5229\u7528\u4f8b<\/h2>\n<p>usbguard\u304c\u8d77\u52d5\u3057\u305f\u5f8c\u306b\u63a5\u7d9a\u3055\u308c\u305f\u30c7\u30d0\u30a4\u30b9\u306fblock\u3055\u308c\u3066\u3044\u307e\u3059\uff0e<\/p>\n<pre><code>$ usbguard list-devices| tail -2\r\n9: allow id 8087:0024 serial &quot;&quot; name &quot;&quot; hash &quot;Zx7v0FMQEjScKSAFENAiobEs1OGPPB0YWR+yXDCVE04=&quot; parent-hash &quot;WwvSEwd+7257rAqUGLMQjffF7zyqygmmLeQTYnR9QzQ=&quot; via-port &quot;4-1&quot; with-interface 09:00:00\r\n11: block id 1004:631c serial &quot;03a809c94b4befd4&quot; name &quot;LGE Android Phone&quot; hash &quot;P5dSK5xxK4R5QTRzd7KlD8Agf\/+28pztL077j1oWqPI=&quot; parent-hash &quot;Zx7v0FMQEjScKSAFENAiobEs1OGPPB0YWR+yXDCVE04=&quot; via-port &quot;4-1.1&quot; with-interface ff:ff:00<\/code><\/pre>\n<p>block\u3055\u308c\u3066\u3044\u308b11\u756a\u76ee\u306e\u30c7\u30d0\u30a4\u30b9\u3092\u8a31\u53ef\u3057\u3066\u307f\u307e\u3059\uff0e\uff08\u3053\u308c\u306f\u4e00\u6642\u7684\u3067\u3059\uff09<\/p>\n<pre><code>$ usbguard allow-device 11\r\n$ usbguard list-devices| tail -1\r\n11: allow id 1004:631c serial &quot;03a809c94b4befd4&quot; name &quot;LGE Android Phone&quot; hash &quot;P5dSK5xxK4R5QTRzd7KlD8Agf\/+28pztL077j1oWqPI=&quot; parent-hash &quot;Zx7v0FMQEjScKSAFENAiobEs1OGPPB0YWR+yXDCVE04=&quot; via-port &quot;4-1.1&quot; with-interface ff:ff:00<\/code><\/pre>\n<h2 id=\"\u72b6\u6cc1\u306e\u78ba\u8a8d\">\u72b6\u6cc1\u306e\u78ba\u8a8d<\/h2>\n<p>USB\u30c7\u30d0\u30a4\u30b9\u306e\u8a8d\u8b58\u72b6\u6cc1\u3092\u76e3\u8996\u3057\u307e\u3059\uff0e<\/p>\n<pre><code>$ usbguard watch\r\n[IPC] Connected\r\n[device] Inserted: id=12 hash=vi38heJ4vKEdayxiqrQFylpwa3xkVYYUkZi2zbu3sWs= name=Mass Storage Device product_id=1336 serial=00000000000006 vendor_id=048d interface={ 08:06:50} rule_match=0 rule_id=4294967295\r\n[device] Blocked: id=12 name=Mass Storage Device product_id=1336 vendor_id=048d rule_match=0 rule_id=4294967295\r\n[device] Allowed: id=12 name=Mass Storage Device product_id=1336 vendor_id=048d rule_match=0 rule_id=4294967295<\/code><\/pre>\n<h2 id=\"guiusbguard-applet-qt\u306e\u5229\u7528\u4f8b\">GUI(usbguard-applet-qt)\u306e\u5229\u7528\u4f8b<\/h2>\n<p>CUI\u3060\u3068\u3061\u3087\u3063\u3068\u9762\u5012\u3067\u3059\u304c\uff0c\u30c7\u30b9\u30af\u30c8\u30c3\u30d7\u5229\u7528\u306e\u5834\u5408\u306f<em>usbguard-applet-qt<\/em>\u304c\u4fbf\u5229\u3067\u3059\uff0e<\/p>\n<p>usbguard-applet-qt\u304c\u8d77\u52d5\u3057\u305f\u72b6\u614b\u3067USB\u30c7\u30d0\u30a4\u30b9\u3092\u63a5\u7d9a\u3059\u308b\u3068\u4ee5\u4e0b\u306e\u3088\u3046\u306a\u30c0\u30a4\u30e4\u30ed\u30b0\u304c\u8868\u793a\u3055\u308c\u307e\u3059\uff0eAllow\u30dc\u30bf\u30f3\u3092\u62bc\u3059\u3053\u3068\u3067\u5229\u7528\u3067\u304d\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3059\uff0e \u3053\u306e\u3068\u304d\uff0c<em>Make the decision permanent<\/em>\u306b\u30c1\u30a7\u30c3\u30af\u3092\u5165\u308c\u3066\u304a\u304f\u3068\uff0c\u8a2d\u5b9a\u304c\u6c38\u7d9a\u5316\u3055\u308c\u307e\u3059\uff0e\u3053\u306e\u8a2d\u5b9a\u306f<em>\/etc\/usbguard\/rules.conf<\/em>\u306b\u8a18\u9332\u3055\u308c\u307e\u3059\uff0e<\/p>\n<p><a data-flickr-embed=\"true\"  href=\"https:\/\/www.flickr.com\/photos\/119142834@N05\/30173864805\/in\/dateposted\/\" title=\"20161007_02:10:22-9078\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/c6.staticflickr.com\/6\/5023\/30173864805_f2e3e26eec_o.jpg\" width=\"423\" height=\"386\" alt=\"20161007_02:10:22-9078\"><\/a><br \/>\n<script async src=\"\/\/embedr.flickr.com\/assets\/client-code.js\" charset=\"utf-8\"><\/script><\/p>\n<p>\u30c0\u30a4\u30e4\u30ed\u30b0\u306f\u30bf\u30a4\u30e0\u30a2\u30a6\u30c8\u3059\u308b\u3068\u6d88\u3048\u3066\u3057\u307e\u3044\u307e\u3059\u304c\uff0c\u30a2\u30d7\u30ec\u30c3\u30c8\u306e\u30a6\u30a3\u30f3\u30c9\u30a6\u304b\u3089\u8a2d\u5b9a\u753b\u9762\u3092\u547c\u3073\u51fa\u3059\u3053\u3068\u304c\u3067\u304d\u307e\u3059\uff0e\u3053\u3053\u304b\u3089\u8a2d\u5b9a\u5909\u66f4\u304c\u3067\u304d\u307e\u3059\uff0e<\/p>\n<p><a data-flickr-embed=\"true\"  href=\"https:\/\/www.flickr.com\/photos\/119142834@N05\/30173861395\/in\/dateposted\/\" title=\"20161007_16:10:49-4107\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/c4.staticflickr.com\/9\/8398\/30173861395_ab4bab9a89.jpg\" width=\"500\" height=\"136\" alt=\"20161007_16:10:49-4107\"><\/a><br \/>\n<script async src=\"\/\/embedr.flickr.com\/assets\/client-code.js\" charset=\"utf-8\"><\/script><\/p>\n<p>\u3068\u308a\u3042\u3048\u305a\u306f\u3053\u308c\u304f\u3089\u3044\u3067\u826f\u3055\u305d\u3046\u3067\u3059\u304c\uff0c\u30eb\u30fc\u30eb\u3092\u66f8\u304f\u3068\u3044\u308d\u3044\u308d\u5fdc\u7528\u304c\u52b9\u304d\u305d\u3046\u3067\u3059\uff0e<\/p>\n<ul>\n<li><a href=\"https:\/\/dkopecek.github.io\/usbguard\/documentation\/rule-language.html\">Rule Language | USBGuard<\/a><\/li>\n<\/ul>\n<p>\u3068\u308a\u3042\u3048\u305a\u306f\u3069\u3046\u3082\u30c7\u30fc\u30e2\u30f3\u8d77\u52d5\u307e\u3067\u306b\u63a5\u7d9a\u3055\u308c\u3066\u3044\u305f\u30c7\u30d0\u30a4\u30b9\u306f\u8a31\u53ef\u3055\u308c\u308b\u3088\u3046\u306a\u306e\u3067\u5185\u81d3\u30c7\u30d0\u30a4\u30b9\u3092\u660e\u793a\u7684\u306b\u8a31\u53ef\u3057\u3066\u305d\u306e\u4ed6\u3092block\u3057\u3088\u3046\u3068\u601d\u3044\u307e\u3059\uff0e<\/p>\n<p><iframe style=\"width:120px;height:240px;\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\" frameborder=\"0\" src=\"\/\/rcm-fe.amazon-adsystem.com\/e\/cm?lt1=_blank&#038;bc1=000000&#038;IS2=1&#038;bg1=FFFFFF&#038;fc1=000000&#038;lc1=0000FF&#038;t=matokensmeme-22&#038;o=9&#038;p=8&#038;l=as4&#038;m=amazon&#038;f=ifr&#038;ref=as_ss_li_til&#038;asins=4774184276&#038;linkId=20066a4ffa1c0400251a6c63c327da97\"><\/iframe><iframe style=\"width:120px;height:240px;\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\" frameborder=\"0\" src=\"\/\/rcm-fe.amazon-adsystem.com\/e\/cm?lt1=_blank&#038;bc1=000000&#038;IS2=1&#038;bg1=FFFFFF&#038;fc1=000000&#038;lc1=0000FF&#038;t=matokensmeme-22&#038;o=9&#038;p=8&#038;l=as4&#038;m=amazon&#038;f=ifr&#038;ref=as_ss_li_til&#038;asins=B00150Z1M6&#038;linkId=28970c20cdcba9ddc95d1a9c65959c16\"><\/iframe><iframe style=\"width:120px;height:240px;\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\" frameborder=\"0\" src=\"\/\/rcm-fe.amazon-adsystem.com\/e\/cm?lt1=_blank&#038;bc1=000000&#038;IS2=1&#038;bg1=FFFFFF&#038;fc1=000000&#038;lc1=0000FF&#038;t=matokensmeme-22&#038;o=9&#038;p=8&#038;l=as4&#038;m=amazon&#038;f=ifr&#038;ref=as_ss_li_til&#038;asins=B00TQMFOCW&#038;linkId=f63b1fa529ce6f1188433c8932e975ed\"><\/iframe><\/p>\n","protected":false},"excerpt":{"rendered":"<p>BadUSB\u306a\u3069\u306e\u4e0d\u6b63\u306aUSB\u30c7\u30d0\u30a4\u30b9\u304b\u3089PC\u304c\u5b88\u308c\u306a\u3044\u304b\u306a\u3061\u3087\u3063\u3068\u8a2d\u5b9a\u3059\u308c\u3070\u3067\u304d\u305d\u3046?\u305d\u3082\u305d\u3082\u4f5c\u3063\u3066\u3044\u308b\u4eba\u304c\u3044\u308b\u3093\u3058\u3083?\u3068\u3044\u3046\u3053\u3068\u3067\u63a2\u3057\u305f\u3089USBGuard\u3068\u3044\u3046\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u3092\u898b\u3064\u3051\u307e\u3057\u305f\uff0e home | USBGua [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"webmentions_disabled_pings":false,"webmentions_disabled":false,"activitypub_content_warning":"","activitypub_content_visibility":"","activitypub_max_image_attachments":4,"activitypub_interaction_policy_quote":"anyone","activitypub_status":"","footnotes":""},"categories":[6],"tags":[276,275,288,168,170,169],"class_list":["post-1439","post","type-post","status-publish","format-standard","hentry","category-linux","tag-debian-linux","tag-linux","tag-ubuntu","tag-usb","tag-usb-killer","tag-usbguard"],"_links":{"self":[{"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/posts\/1439","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/comments?post=1439"}],"version-history":[{"count":0,"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/posts\/1439\/revisions"}],"wp:attachment":[{"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/media?parent=1439"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/categories?post=1439"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/tags?post=1439"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}