{"id":1451,"date":"2016-10-10T00:37:06","date_gmt":"2016-10-09T15:37:06","guid":{"rendered":"http:\/\/matoken.org\/blog\/?p=1451"},"modified":"2016-10-10T00:50:26","modified_gmt":"2016-10-09T15:50:26","slug":"set-the-initial-device-of-usbguard","status":"publish","type":"post","link":"https:\/\/matoken.org\/blog\/2016\/10\/10\/set-the-initial-device-of-usbguard\/","title":{"rendered":"USBGuard\u306e\u521d\u671f\u30c7\u30d0\u30a4\u30b9\u3092\u8a2d\u5b9a"},"content":{"rendered":"<p>USBGuard\u306f\u305d\u306e\u307e\u307e\u3060\u3068\u30c7\u30fc\u30e2\u30f3\u8d77\u52d5\u6642\u306b\u63a5\u7d9a\u3055\u308c\u3066\u3044\u305f\u30c7\u30d0\u30a4\u30b9\u306f\u5168\u3066\u8a31\u53ef\u3055\u308c\u308b\u306e\u3067\u4e0d\u6b63\u306a\u30c7\u30d0\u30a4\u30b9\u304c\u8d77\u52d5\u6642\u306b\u65e2\u306b\u53d6\u308a\u4ed8\u3051\u3089\u308c\u3066\u3044\u305f\u5834\u5408\u8a31\u53ef\u3055\u308c\u3066\u3057\u307e\u3044\u307e\u3059\uff0e \u305d\u3053\u3067\u624b\u52d5\u3067\u5229\u7528\u53ef\u80fd\u30c7\u30d0\u30a4\u30b9\u3092allow\u3067\u8a2d\u5b9a\u306b\uff0c\u305d\u3057\u3066\u305d\u308c\u4ee5\u5916\u3092block\u306b\u3057\u305f\uff0eblock\u3067\u306a\u304freject\u306e\u65b9\u304c\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306f\u4e0a\u304c\u308b\u3051\u3069\u8a31\u53ef\u3057\u305f\u3044\u5834\u5408\u9762\u5012\u306a\u306e\u3067\u3068\u308a\u3042\u3048\u305a\u30d6\u30ed\u30c3\u30af\u306b\uff0e \u3053\u308c\u3067allow\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u306a\u3044\u30c7\u30d0\u30a4\u30b9\u3092\u7e4b\u3050\u3068block\uff0e\u305d\u306e\u30c7\u30d0\u30a4\u30b9\u3092\u5229\u7528\u3057\u305f\u3044\u5834\u5408\u306f\u624b\u52d5\u3067<em>allow-device <id><\/em>\u3084<em>usbguard-applet-qt<\/em>\u3067allow\u306b\u3059\u308c\u3070\u4f7f\u3048\u307e\u3059\uff0e<\/p>\n<p>\u203bUSBGuard\u306f\u6b21\u306e\u30da\u30fc\u30b8\u306e\u8a2d\u5b9a(\u30e6\u30fc\u30b6\uff0c\u30b0\u30eb\u30fc\u30d7\u8a2d\u5b9a)\u304c\u6e08\u3093\u3067\u3044\u308b\u524d\u63d0\u3067\u3059\uff0e<\/p>\n<ul>\n<li><a href=\"https:\/\/matoken.org\/blog\/blog\/2016\/10\/08\/try-usbguard-to-protect-the-pc-from-unauthorized-usb-device\/\" title=\"\u4e0d\u6b63\u306aUSB\u30c7\u30d0\u30a4\u30b9\u304b\u3089PC\u3092\u5b88\u308bUSBGuard\u3092\u8a66\u3059 | matoken&#39;s meme\">\u4e0d\u6b63\u306aUSB\u30c7\u30d0\u30a4\u30b9\u304b\u3089PC\u3092\u5b88\u308bUSBGuard\u3092\u8a66\u3059 | matoken&#8217;s meme<\/a><\/li>\n<\/ul>\n<h2 id=\"\u30eb\u30fc\u30eb\u30d5\u30a1\u30a4\u30eb\u3092\u4f5c\u6210\">\u30eb\u30fc\u30eb\u30d5\u30a1\u30a4\u30eb\u3092\u4f5c\u6210<\/h2>\n<p>\u307e\u305a\u306f<em>generate-policy<\/em>\u3067\u73fe\u5728\u306e\u72b6\u614b\u3092\u30d5\u30a1\u30a4\u30eb\u306b\u66f8\u304d\u51fa\u3057\u3066\u7de8\u96c6\u3057\u307e\u3059\uff0e \u3053\u3053\u3067\u306f\u5185\u8535\u30ab\u30e1\u30e9\u3082block\u306b\u3057\u3066\u3044\u307e\u3059\uff0e<\/p>\n<pre><code>$ usbguard generate-policy &gt; rules.conf\r\n$ vi rules.conf\r\n$ sudo cat \/etc\/usbguard\/rules.conf\r\nallow id 1d6b:0002 serial &quot;0000:00:1a.0&quot; name &quot;EHCI Host Controller&quot; hash &quot;MwANH+QnAvclGgMNHjzanbOGkp3bPmwqoyAEZZ6QXTQ=&quot; parent-hash &quot;uvJm0y\/N2iYeJgfKJsJqWKTJts\/duhYZ7W2zzAYk7Y8=&quot; with-interface 09:00:00\r\nallow id 8087:0024 serial &quot;&quot; name &quot;&quot; hash &quot;kv3v2+rnq9QvYI3\/HbJ1EV9vdujZ0aVCQ\/CGBYIkEB0=&quot; parent-hash &quot;MwANH+QnAvclGgMNHjzanbOGkp3bPmwqoyAEZZ6QXTQ=&quot; via-port &quot;3-1&quot; with-interface 09:00:00\r\nallow id 0a5c:21e6 serial &quot;2016D8DA016E&quot; name &quot;BCM20702A0&quot; hash &quot;C4Os63DCRvIuWJYU\/U+1PXrvWlXa2PmpRUQhp+C5eeE=&quot; parent-hash &quot;kv3v2+rnq9QvYI3\/HbJ1EV9vdujZ0aVCQ\/CGBYIkEB0=&quot; with-interface { ff:01:01 ff:01:01 ff:01:01 ff:01:01 ff:01:01 ff:01:01 ff:01:01 ff:ff:ff fe:01:01 }\r\nallow id 17ef:100a serial &quot;&quot; name &quot;&quot; hash &quot;dMjTmGpj5dFGqH51kQpO\/LVBQxE6JkwibVRJQkFCCuU=&quot; parent-hash &quot;kv3v2+rnq9QvYI3\/HbJ1EV9vdujZ0aVCQ\/CGBYIkEB0=&quot; via-port &quot;3-1.5&quot; with-interface { 09:00:01 09:00:02 }\r\nblock id 04f2:b217 serial &quot;&quot; name &quot;Integrated Camera&quot; hash &quot;BxFRAwzjkHO55cQGR8oMRm6bq+Ps2qQtU88jE1Uk5KE=&quot; parent-hash &quot;kv3v2+rnq9QvYI3\/HbJ1EV9vdujZ0aVCQ\/CGBYIkEB0=&quot; via-port &quot;3-1.6&quot; with-interface { 0e:01:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 }\r\nallow id 1d6b:0002 serial &quot;0000:05:00.0&quot; name &quot;xHCI Host Controller&quot; hash &quot;IV7wk04gfQJink\/IY4TiGVdcmTzuc09WcSe6k57kWrs=&quot; parent-hash &quot;3TIXKJ1dp4XFV6VxxWU11xbI0yLS0VmRZIaxdsLZDx4=&quot; with-interface 09:00:00\r\nallow id 1d6b:0003 serial &quot;0000:05:00.0&quot; name &quot;xHCI Host Controller&quot; hash &quot;VlZK5oVuQQAlBH76Ekgc+KaZZDL0BAsF9tEf1ynb154=&quot; parent-hash &quot;3TIXKJ1dp4XFV6VxxWU11xbI0yLS0VmRZIaxdsLZDx4=&quot; with-interface 09:00:00\r\nallow id 1d6b:0002 serial &quot;0000:00:1d.0&quot; name &quot;EHCI Host Controller&quot; hash &quot;WwvSEwd+7257rAqUGLMQjffF7zyqygmmLeQTYnR9QzQ=&quot; parent-hash &quot;FjkaT8Rp\/Bh++KC4RQhk++hWack2wTDa1a1G5yXqYys=&quot; with-interface 09:00:00\r\nallow id 8087:0024 serial &quot;&quot; name &quot;&quot; hash &quot;Zx7v0FMQEjScKSAFENAiobEs1OGPPB0YWR+yXDCVE04=&quot; parent-hash &quot;WwvSEwd+7257rAqUGLMQjffF7zyqygmmLeQTYnR9QzQ=&quot; via-port &quot;4-1&quot; with-interface 09:00:00\r\nblock<\/code><\/pre>\n<h2 id=\"\u30eb\u30fc\u30eb\u30d5\u30a1\u30a4\u30eb\u3092\u53cd\u6620\u3057\u3066\u52d5\u4f5c\u78ba\u8a8d\">\u30eb\u30fc\u30eb\u30d5\u30a1\u30a4\u30eb\u3092\u53cd\u6620\u3057\u3066\u52d5\u4f5c\u78ba\u8a8d<\/h2>\n<p>\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u3092\u30b3\u30d4\u30fc\u3057\u3066\u30c7\u30fc\u30e2\u30f3\u3092\u518d\u8d77\u52d5\u3057\u3066\u53cd\u6620\uff0e<\/p>\n<pre><code>$ sudo install -m 0600 -o root -g root rules.conf \/etc\/usbguard\/rules.conf\r\n$ sudo systemctl restart usbguard<\/code><\/pre>\n<p>\u3053\u308c\u3067allow\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u306a\u3044USB\u30c7\u30d0\u30a4\u30b9\u3092\u63a5\u7d9a\u3057\u305f\u72b6\u614b\u3067\u8d77\u52d5\u3057\u3066\u3082block\u306b\uff0c\u65b0\u3057\u3044USB\u30c7\u30d0\u30a4\u30b9\u3092\u63a5\u7d9a\u3057\u3066\u3082block\u306b\u306a\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3059\uff0e<\/p>\n<h2 id=\"\u65b0\u3057\u3044\u30c7\u30d0\u30a4\u30b9\u3092\u624b\u52d5\u3067\u8a31\u53ef\u3059\u308b\">\u65b0\u3057\u3044\u30c7\u30d0\u30a4\u30b9\u3092\u624b\u52d5\u3067\u8a31\u53ef\u3059\u308b<\/h2>\n<p>\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u306a\u3044\u30c7\u30d0\u30a4\u30b9\u3092\u5229\u7528\u3057\u305f\u3044\u5834\u5408\u306f\u4ee5\u4e0b\u306e\u3088\u3046\u306b<em>list-devices<\/em>\u3067id\u3092\u78ba\u8a8d\u3057\u3066<em>allow-device <id><\/em>\u3084<em>usbguard-applet-qt<\/em>\u3067allow\u306b\u3057\u3066\u4f7f\u3048\u308b\u3088\u3046\u306b\u3057\u307e\u3059\uff0e<\/p>\n<pre><code>$ usbguard list-devices | grep block\r\n15: block id 04f2:b217 serial &quot;&quot; name &quot;Integrated Camera&quot; hash &quot;BxFRAwzjkHO55cQGR8oMRm6bq+Ps2qQtU88jE1Uk5KE=&quot; parent-hash &quot;kv3v2+rnq9QvYI3\/HbJ1EV9vdujZ0aVCQ\/CGBYIkEB0=&quot; via-port &quot;3-1.6&quot; with-interface { 0e:01:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 }\r\n20: block id 1004:631c serial &quot;03a809c94b4befd4&quot; name &quot;LGE Android Phone&quot; hash &quot;0qSmncueL3SVg+z6yyVNMG2l+KxlAsMZWRfpPvCp0oU=&quot; parent-hash &quot;Zx7v0FMQEjScKSAFENAiobEs1OGPPB0YWR+yXDCVE04=&quot; via-port &quot;4-1.1&quot; with-interface ff:ff:00\r\n$ usbguard allow-device 20<\/code><\/pre>\n<p><a data-flickr-embed=\"true\"  href=\"https:\/\/www.flickr.com\/photos\/119142834@N05\/29918228940\/in\/dateposted\/\" title=\"20161010_00:10:37-11962\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/c5.staticflickr.com\/9\/8417\/29918228940_2aa0318acc_o.jpg\" width=\"531\" height=\"394\" alt=\"20161010_00:10:37-11962\"><\/a><br \/>\n<script async src=\"\/\/embedr.flickr.com\/assets\/client-code.js\" charset=\"utf-8\"><\/script><\/p>\n<p>\u3068\u308a\u3042\u3048\u305a\u3053\u308c\u3067\u826f\u3055\u305d\u3046\u3067\u3059\u304c\uff0c\u305f\u307e\u306bSSD\u3092\u5dee\u3057\u66ff\u3048\u308b\u3053\u3068\u304c\u3042\u308a\u307e\u3059\uff0e\u305d\u3046\u3059\u308b\u3068\u524d\u3082\u3063\u3066\u8a2d\u5b9a\u3057\u76f4\u3057\u3066\u304a\u304b\u306a\u3044\u3068\u30c7\u30d0\u30a4\u30b9\u304c\u8a8d\u8b58\u305b\u305a\u4e0d\u5473\u3044\u3053\u3068\u304c\u8d77\u3053\u308a\u305d\u3046\u3067\u3059\uff0e\u3068\u3044\u3046\u3053\u3068\u3067\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u306bhostname\u3092\u4ed8\u3051\u3066\u305d\u308c\u3092\u4f7f\u3046\u3088\u3046\u306b\u3057\u3066\u307f\u307e\u3057\u305f\uff0e<\/p>\n<h2 id=\"host\u3054\u3068\u306e\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u3092\u4f5c\u308b\">host\u3054\u3068\u306e\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u3092\u4f5c\u308b<\/h2>\n<p>\u8d77\u52d5\u6642\u306b\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u306f\u6307\u5b9a\u3067\u304d\u307e\u3059\u304c\uff0c\u30eb\u30fc\u30eb\u30d5\u30a1\u30a4\u30eb\u306f\u6307\u5b9a\u3067\u304d\u306a\u3044\u3088\u3046\u3067\u3059\uff0e\u4e21\u65b9\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u30db\u30b9\u30c8\u3054\u3068\u306b\u7528\u610f\u3057\u307e\u3059\uff0e<\/p>\n<pre><code>$ sudo cp -p \/etc\/usbguard\/usbguard-daemon.conf \/etc\/usbguard\/usbguard-daemon-`hostname`.conf\r\n$ sudo vi \/etc\/usbguard\/usbguard-daemon-x220.conf\r\n$ diff \/etc\/usbguard\/usbguard-daemon.conf \/etc\/usbguard\/usbguard-daemon-x220.conf\r\n10c10\r\n&lt; RuleFile=\/etc\/usbguard\/rules.conf\r\n---\r\n&gt; RuleFile=\/etc\/usbguard\/rules-x220.conf\r\n$ sudo cp -p \/etc\/usbguard\/rules.conf \/etc\/usbguard\/rules-`hostname`.conf<\/code><\/pre>\n<h2 id=\"systemd\u306e\u8d77\u52d5\u30d5\u30a1\u30a4\u30eb\u3092\u4fee\u6b63\u3057\u3066\u30db\u30b9\u30c8\u540d\u4ed8\u304d\u306e\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u3092\u4f7f\u3046\u3088\u3046\u306b\u3059\u308b\">systemd\u306e\u8d77\u52d5\u30d5\u30a1\u30a4\u30eb\u3092\u4fee\u6b63\u3057\u3066\u30db\u30b9\u30c8\u540d\u4ed8\u304d\u306e\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u3092\u4f7f\u3046\u3088\u3046\u306b\u3059\u308b<\/h2>\n<p>Systemd\u306e\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u3092\u7528\u610f\u3057\u3066\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u3092\u30db\u30b9\u30c8\u540d\u4ed8\u304d\u3067\u547c\u3076\u3088\u3046\u306b\u4fee\u6b63\u3057\u307e\u3057\u305f\uff0e<\/p>\n<pre><code>$ sudo vi \/etc\/systemd\/system\/usbguard.service\r\n$ cat \/etc\/systemd\/system\/usbguard.service\r\n[Unit]\r\nDescription=USBGuard daemon\r\nWants=systemd-udevd.service local-fs.target\r\nDocumentation=man:usbguard-daemon(8)\r\n\r\n[Service]\r\nType=simple\r\nExecStartPre=\/bin\/bash -c &quot;\/bin\/systemctl set-environment hostname=$(\/bin\/hostname)&quot;\r\nExecStart=\/usr\/sbin\/usbguard-daemon -k -c \/etc\/usbguard\/usbguard-daemon-${hostname}.conf\r\nRestart=on-failure\r\n\r\n[Install]\r\nWantedBy=basic.target<\/code><\/pre>\n<p>\u8d77\u52d5\u3057\u76f4\u3057\u3066\u78ba\u8a8d\u3057\u3066\u307f\u308b\u3068\u30db\u30b9\u30c8\u540d\u4ed8\u304d\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u547c\u3093\u3067\u3044\u307e\u3059\uff0e<\/p>\n<pre><code>$ sudo systemctl daemon-reload\r\n$ sudo service usbguard restart\r\n$ hostname\r\nx220\r\n$ ps -ef|grep -i usbguard-daemon\r\nroot     28545     1  0 00:05 ?        00:00:00 \/usr\/sbin\/usbguard-daemon -k -c \/etc\/usbguard\/usbguard-daemon-x220.conf<\/code><\/pre>\n<p>\u3061\u3087\u3063\u3068\u9762\u5012\u3067\u3059\u304c\u3068\u308a\u3042\u3048\u305a\u3053\u308c\u3067\u884c\u3051\u305d\u3046\u3067\u3059\uff0e<\/p>\n<p><iframe style=\"width:120px;height:240px;\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\" frameborder=\"0\" src=\"\/\/rcm-fe.amazon-adsystem.com\/e\/cm?lt1=_blank&#038;bc1=000000&#038;IS2=1&#038;bg1=FFFFFF&#038;fc1=000000&#038;lc1=0000FF&#038;t=matokensmeme-22&#038;o=9&#038;p=8&#038;l=as4&#038;m=amazon&#038;f=ifr&#038;ref=as_ss_li_til&#038;asins=B01LDFK758&#038;linkId=aad05b1cd143e2af18b04a7a09b2e4c2\"><\/iframe><iframe style=\"width:120px;height:240px;\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\" frameborder=\"0\" src=\"\/\/rcm-fe.amazon-adsystem.com\/e\/cm?lt1=_blank&#038;bc1=000000&#038;IS2=1&#038;bg1=FFFFFF&#038;fc1=000000&#038;lc1=0000FF&#038;t=matokensmeme-22&#038;o=9&#038;p=8&#038;l=as4&#038;m=amazon&#038;f=ifr&#038;ref=as_ss_li_til&#038;asins=B016QAH2YE&#038;linkId=6399a763ef223bd0319c10f5eee890b9\"><\/iframe><iframe style=\"width:120px;height:240px;\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\" frameborder=\"0\" src=\"\/\/rcm-fe.amazon-adsystem.com\/e\/cm?lt1=_blank&#038;bc1=000000&#038;IS2=1&#038;bg1=FFFFFF&#038;fc1=000000&#038;lc1=0000FF&#038;t=matokensmeme-22&#038;o=9&#038;p=8&#038;l=as4&#038;m=amazon&#038;f=ifr&#038;ref=as_ss_li_til&#038;asins=B00DTMA9A2&#038;linkId=faa0531de87490f0a9c06be8b543ca9f\"><\/iframe><\/p>\n","protected":false},"excerpt":{"rendered":"<p>USBGuard\u306f\u305d\u306e\u307e\u307e\u3060\u3068\u30c7\u30fc\u30e2\u30f3\u8d77\u52d5\u6642\u306b\u63a5\u7d9a\u3055\u308c\u3066\u3044\u305f\u30c7\u30d0\u30a4\u30b9\u306f\u5168\u3066\u8a31\u53ef\u3055\u308c\u308b\u306e\u3067\u4e0d\u6b63\u306a\u30c7\u30d0\u30a4\u30b9\u304c\u8d77\u52d5\u6642\u306b\u65e2\u306b\u53d6\u308a\u4ed8\u3051\u3089\u308c\u3066\u3044\u305f\u5834\u5408\u8a31\u53ef\u3055\u308c\u3066\u3057\u307e\u3044\u307e\u3059\uff0e \u305d\u3053\u3067\u624b\u52d5\u3067\u5229\u7528\u53ef\u80fd\u30c7\u30d0\u30a4\u30b9\u3092allow\u3067\u8a2d\u5b9a\u306b\uff0c\u305d\u3057\u3066\u305d [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"webmentions_disabled_pings":false,"webmentions_disabled":false,"activitypub_content_warning":"","activitypub_content_visibility":"","activitypub_max_image_attachments":4,"activitypub_interaction_policy_quote":"anyone","activitypub_status":"","footnotes":""},"categories":[6],"tags":[275,173,169,10],"class_list":["post-1451","post","type-post","status-publish","format-standard","hentry","category-linux","tag-linux","tag-sec","tag-usbguard","tag-10"],"_links":{"self":[{"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/posts\/1451","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/comments?post=1451"}],"version-history":[{"count":0,"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/posts\/1451\/revisions"}],"wp:attachment":[{"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/media?parent=1451"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/categories?post=1451"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/matoken.org\/blog\/wp-json\/wp\/v2\/tags?post=1451"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}