Arch Linux

coolguy21

Member

Registered: 2016-07-05

Posts: 87

force usb mount via encryption

Hi all,

I need some ideas on how to do this (if it is possible of course)..

I want to be able to setup my arch system such that it will not open any connected usb drives/flash un-encrypted. It must somehow force to mount it via encryption. Is this possible?

Thanks.

wudu

Member

Registered: 2010-03-08

Posts: 83

Re: force usb mount via encryption

Not sure if I understand correctly. I guess you clicked (at some point) "never forget" password for your encrypted devices in your file manager and now you don't have to give the password anymore to mount them. If that's your problem you can install seahorse and remove the saved passwords.

If that's not your problem please try to describe it again. I guess it isn't clear for others as well...

Last edited by wudu (2016-08-15 18:20:11)

coolguy21

Member

Registered: 2016-07-05

Posts: 87

Re: force usb mount via encryption

No actually,

I want to be able to setup my arch to reject any usb that's plugged in to the system that is NOT encrypted.

So it must enforce an Encryption-ONLY rule across the system.

Sorry if it wasn't clear in my earlier post.

Cheers,

ukhippo

Member

From: Non-paged pool

Registered: 2014-02-21

Posts: 366

Re: force usb mount via encryption

Who/what are you trying to prevent? Everyone including root? Ordinary users? A DE's automounter?
You can't really stop root, so by implication that also means those who can get root rights via su/sudo.

coolguy21

Member

Registered: 2016-07-05

Posts: 87

Re: force usb mount via encryption

I understand root is unstoppable and su/sudo. This is for ordinary users who don't have access to su privileges.

Can I set automounter to do this or another way?

ukhippo

Member

From: Non-paged pool

Registered: 2014-02-21

Posts: 366

Re: force usb mount via encryption

If you use an automounter based on udisks2, use udev rules to set “UDISKS_IGNORE” to “1”

Eg. something along the lines of:

KERNEL=="sd??*",ENV{ID_FS_TYPE}!="crypto_LUKS",ENV{UDISKS_IGNORE}="1"