I have to setup a monitoring system for our internet server, to monitor which USB Flash Drives (Pen Drives) are mounted and unmounted and when.(This is to avoid misuse, and to capture which unauthorized device is/was connected.)
Is there any method to monitor flash drive information such as : a) Serial Number, b) Make, c) Model, d) Capacity e) Label f) Time of mount/unmount etc., and store it, to view history about it?
I know there are number of commands to monitor currently mounted USB devices. Like lsusb
,lshw
. But how do I store that information.
Best Answer
Well, there is no ready-for-that software I know. But you can write your own script, which will be started when pendrive is inserted|removed from usb port. This script would be run by udev if you add this to
/etc/udev/rules/99-local.rules
:and then in this script you will have following environment variables:
You can examine the pendrive with:
to get capacity and partition layout. And do various stuff like that. You can store information in file or in database. All is up to you. You can even deny access to this device if you like by sending SCSI STOP UNIT and removing the drive from system.
It is also important to check the
${ID_BUS}
to examine only usb devices. It is important to check the${DEVTYPE}
because the script will also be called for every partition on usb device:Maybe it is a good idea to limit access when
${DEVTYPE}=disk
but store information about all partitions –${DEVTYPE}=partition
.HTH, Cheers