Ubuntu Server, like almost all modern Linux distributions, automatically loads the usb-storage kernel module whenever a USB flash drive or external hard drive is physically plugged into the machine. This allows administrators to easily mount external media and copy files via the command line.
However, in high-security environments, physical data exfiltration is a massive threat vector. If an unauthorized actor gains physical access to a bare-metal server in a data center (or even an edge-computing gateway device in a retail store), they can simply plug in a massive 2TB USB drive, mount it, and quietly copy the entire database or configuration directory in minutes. To guarantee that your server is physically immune to “sneakernet” data theft, you must instruct the Linux kernel to completely block the initialization of all USB storage devices.
Disabling USB Storage via Kernel Module Blacklisting
The most robust way to prevent USB drives from functioning is to “blacklist” the kernel driver responsible for mounting them. If the driver cannot load, the operating system cannot communicate with the hardware.
- Open a Terminal session (or connect to your server via SSH).
- You must create a new configuration file in the modprobe directory. Open a new file with root privileges:
sudo nano /etc/modprobe.d/blacklist-usb-storage.conf - Paste the following command into the empty file:
install usb-storage /bin/true
(This line tricks the kernel. When it attempts to load the usb-storage module, it instead executes the `/bin/true` command, which instantly returns a success code and exits, completely bypassing the actual driver initialization). - Save the file (Ctrl + O, then Enter) and exit the text editor (Ctrl + X).
- You must now update the initramfs (Initial RAM Filesystem) so the blacklist is enforced at the earliest possible stage of the boot sequence:
sudo update-initramfs -u - Reboot your server immediately:
sudo reboot
Once the server comes back online, plug in a USB flash drive. The kernel will completely ignore it. The drive will not appear under lsblk or fdisk -l, and it will be mathematically impossible to mount or access the hardware, ensuring absolute physical data security.