Restrict USB Ports

[dlew]

Hi All,

We've had a request from our security team to restrict access to usb ports on a mac mini used as a dashboard machine. So far we've removed the following kext files below to try and restrict access but have only been successful at preventing USB mice from connecting after a restart. If someone is familiar with the other kext files we need to remove to prevent USB keyboard access it would be much appreciated. Thanks in a advance!

mv /System/Library/Extensions/IOUSBMassStorageClass.kext /System/Library/Extensions/IOUSBMassStorageClass.kext.bk

mv /System/Library/Extensions/IOUSBAttachedSCSI.kext /System/Library/Extensions/IOUSBAttachedSCSI.kext.bk

mv /System/Library/Extensions/IOUSBFamily.kext /System/Library/Extensions/IOUSBFamily.kext.bk

mv /System/Library/Extensions/IOUSBHostFamily.kext /System/Library/Extensions/IOUSBHostFamily.kext.bk

mv /System/Library/Extensions/IOUSBMassStorageDriver.kext /System/Library/Extensions/IOUSBMassStorageDriver.kext.bk

mv /System/Library/Extensions/AppleUSBTopCase.kext/Contents/PlugIns/AppleUSBTCKeyboard.kext /System/Library/Extensions/AppleUSBTopCase.kext/Contents/PlugIns/AppleUSBTCKeyboard.kext.bk

[Person]

Have you tried the Restrictions configuration profile?

[Bhughes]

Sounds fun! We're going through a security audit too.... I @Pearson has a good thought here.... I think this would work.

[htse]

You may fare better with AppleHIDKeyboard.kext and AppleHIDMouse.kext. AppleUSBTopCase.kext applies more to MacBook-esque systems with Top Cases.

[dlew]

Thanks @Person & @Bhughes. I looked at the restrictions configuration profile before and that was able to block bluetooth as one of our other requirements but from what I understand the media section only blocks certain peripherals and not all USB devices?

Thanks @htse I'll give those two kext files a shot.

[davidacland]

Chopping out kexts is going to cause difficulty with the OS, particularly in 10.11 and SIP.

I would probably use EndpointProtector for this type of thing.

http://endpointprotector.com

[dlew]

Thanks @davidacland from reading the description of EndpointProtector it looks like this just targets USB storage media. Have you used this product before and locked down the USB ports completely?

[jalcorn]

So i couldn't get the above screen shot to work. Could anyone? USB still has write to it.

[Josh_Smith]

@jalcorn The config profile always worked for me in 10.10 and 10.11 but didn't take effect until after a reboot. We blocked USB storage altogether, didn't try just restricting writes. I assume you are choosing "Read-Only".

[guidotti]

Is this config profile payload still the gold standard for locking down USB ports on 10.13?

[Quan_nong]

I also use "Restrictions Payload" in Configuration Profile to lockdown access of USB and have had no issues. If you using the Mac mini as a Dashboard, it doesnt need access sort of Access even "Airdrop" to copy files off.

We have all the options unticked, since we have iMac's used as Build Monitors for developers to monitor Jenkin Pipeline Jobs etc

[mani2care]

I have tried with JAMF by doing the USB -Read-only but once worked me and after reboot the machine still working there is no use is it working

[janderson1]

Same happens for me @mani2care Did you find a solution for this?

[mani2care]

@janderson1 I hope if the profile1 is enabled the USB access & Profile 2 is disabled the USB access but the issue there are number of profiles with the above configuration to be witch one will be considered ?

so the issue is occurring because of Conflict number of profile as like given below so need to be mergied the profiles.

[mani2care]

i found the solution for the USB block -> Restriction compliance should be a one -> MDM profile allow once impact the machines -> if has more configuration profile it conflicting.
1) profile 1 -> Allowed the USB 2) Profile 2 ->Blocked USB it means which will accept the MAC so here conflicting the restriction validate the older restriction tab and make it one and push to end user machines workd perfect.

[mani2care]

but is there any way to know the extension attribute to aware the USB blocked or not