How to disable USB Thumbdrive on CA API Hardware Appliance Gateway 9.x
Article ID: 110259
Updated On:
Products
CA API Gateway (Layer 7)
SA94 to API SECURITY
STARTER PACK-7
CA Rapid App Security
MOBILE API GATEWAY
CA Mobile - API Gateway
CA API Gateway
Issue/Introduction
Customers might like to disable the USB thumbdrive on the CA API Gateway hardware appliance for security reason but would like to keep the USB connectivity for Keyboard/Mouse.
Environment
CA API Gateway hardware appliance 9.x running on Oracle Server X5-2.
Resolution
The following solution involves blacklisting a kernel module and unloading it upon boot.
This is the safest solution that we are aware of as it can be reversed, quickly, with no negative effects.
Some instructions say to move the kernel module file but this creates additional problems.
Even-though this is generally unsupported thing to do, but it would not be dangerous.
These instructions are RHEL/CentOS6 specific:
Instructions
The following instructions will disable usb storage but will not affect simple devices such as keyboards and mouse.
Please note that a reimage of a hardware appliance may modify these settings.
This is the safest method possible as it is not possible to only disable USB Storage on a BIOS level and you do not want to do this via GRUB during boot.
Disable
echo 'blacklist usb_storage' > /etc/modprobe.d/blacklist-usb_storage.conf
echo 'modprobe -r usb_storage' > /etc/rc.local
Reboot
Enable
rm /etc/modprobe.d/blacklist-usb_storage.conf
Remove 'modprobe -r usb_storage' from /etc/rc.local
Reboot
This is the safest solution that we are aware of as it can be reversed, quickly, with no negative effects.
Some instructions say to move the kernel module file but this creates additional problems.
Even-though this is generally unsupported thing to do, but it would not be dangerous.
These instructions are RHEL/CentOS6 specific:
Instructions
The following instructions will disable usb storage but will not affect simple devices such as keyboards and mouse.
Please note that a reimage of a hardware appliance may modify these settings.
This is the safest method possible as it is not possible to only disable USB Storage on a BIOS level and you do not want to do this via GRUB during boot.
Disable
echo 'blacklist usb_storage' > /etc/modprobe.d/blacklist-usb_storage.conf
echo 'modprobe -r usb_storage' > /etc/rc.local
Reboot
Enable
rm /etc/modprobe.d/blacklist-usb_storage.conf
Remove 'modprobe -r usb_storage' from /etc/rc.local
Reboot
Feedback
Yes
No
Powered by
