How to Use `USBGuard` to Block Unauthorized USB Devices on Linux.

USB devices such as keyboards, mice, flash drives, and cameras are essential, but they can also pose a security risk. A USB device may present itself as an unexpected device type or attempt to exploit the system. USBGuard helps Linux administrators control which USB devices are authorized to interact with a computer.

This guide explains how to install USBGuard on Ubuntu or Debian, create an initial policy, allow a trusted USB drive, and manage persistent rules.

Important: USBGuard can block your keyboard or mouse. Before starting the daemon, create and review an initial policy that includes the USB devices you need. If possible, keep another way to access the computer, such as SSH.

USBGuard

USBGuard is a Linux framework for enforcing USB device authorization policies. Its background daemon monitors USB devices and evaluates them against an ordered set of rules. A rule can:

• Allow a device to communicate with the system.
• Block a device while leaving it present.
• Reject a device by deauthorizing and removing it until it is reconnected.

Rules can match device attributes such as vendor and product ID, serial number, name, USB port, interface type, and a USBGuard-computed hash. These attributes help distinguish devices, but they are based on information supplied by or derived from USB descriptors; they are not proof that a device is trustworthy.

USBGuard includes the usbguard command-line tool for listing devices and managing policy. Devices that do not match a rule are handled according to the daemon's configured implicit policy, which is commonly set to block them.

Install USBGuard

On Ubuntu or Debian, install the package with:

$ sudo apt update
$ sudo apt install usbguard

Package availability and service defaults vary by distribution. Use your distribution's instructions if these commands do not apply.

Create an initial policy before starting USBGuard

USBGuard's generate-policy command prints rules that authorize devices connected at the time it runs. The USBGuard project recommends creating and reviewing this initial policy before starting the daemon, especially to avoid blocking your keyboard or mouse.

Generate a draft in your current directory:

$ sudo usbguard generate-policy > rules.conf

Open rules.conf in a text editor and review the rules. Confirm that the devices you need—such as your keyboard, mouse, and any internal USB devices—are represented. The generated policy applies to devices connected at generation time; newly connected devices may be blocked if they do not match a rule.

After reviewing the file, back up any existing policy and install the reviewed file:

$ sudo cp /etc/usbguard/rules.conf /etc/usbguard/rules.conf.bak
$ sudo install -m 0600 -o root -g root rules.conf /etc/usbguard/rules.conf

If /etc/usbguard/rules.conf does not exist yet, the backup command will report an error; in that case, skip the backup command. The install command replaces the destination policy file with the reviewed draft.

Enable and start the daemon:

$ sudo systemctl enable --now usbguard.service

Check that it is running:

$ sudo systemctl status usbguard.service

List connected USB devices

Display the devices recognized by USBGuard:

$ sudo usbguard list-devices

A device entry begins with an internal USBGuard device ID, followed by its authorization state and attributes. For example:

31: block id 0781:5581 ...

Here, 31 is the internal device ID used by commands such as allow-device. The 0781:5581 value is the USB vendor:product ID; it identifies a product model, not necessarily one individual drive.

Device entries may also show a name, serial number, port, interface information, and hash. USBGuard computes the hash from device attributes and descriptor data. A hash can make a rule more specific, but it does not prevent a malicious device from spoofing identifying information.

Allow a USB device temporarily

To authorize a blocked device for the current runtime policy, use the internal device ID shown at the start of its entry:

$ sudo usbguard allow-device 31

Replace 31 with the correct ID from your system. Without --permanent, this command does not append a persistent allow rule to the policy file.

Allow a USB device permanently

To authorize a device and append a device-specific allow rule to the current policy, use:

$ sudo usbguard allow-device --permanent 31

Replace 31 with the device's internal ID. Inspect the active rules afterward:

$ sudo usbguard list-rules

A permanent rule is only as specific as its matching attributes. Review the resulting rule, particularly if you intend to authorize one physical device rather than every device of a particular model.

Add a rule manually

USBGuard rules use their own syntax. For example, this rule matches a USB device by vendor:product ID and serial number:

allow id 0781:5581 serial "4C530001070320117223" label "Backup drive"

The values above are examples; replace them with the attributes shown for your own device. USBGuard supports attributes including id, serial, hash, name, via-port, and with-interface.

The label attribute adds a human-readable note to a rule. It does not affect device matching. A # starts a comment in the rules file, but a comment is not the same as a rule label.

If you edit /etc/usbguard/rules.conf directly, save a backup first, then restart USBGuard to reload the policy:

$ sudo cp /etc/usbguard/rules.conf /etc/usbguard/rules.conf.bak
$ sudo systemctl restart usbguard.service

Verify the active rules and device status:

$ sudo usbguard list-rules
$ sudo usbguard list-devices

Use generate-policy safely

generate-policy creates rules for devices connected when the command runs. It is useful for creating an initial baseline, but redirecting its output directly to /etc/usbguard/rules.conf can overwrite your existing rules.

For a new draft, write to a separate file and review it before installing:

$ sudo usbguard generate-policy > rules-new.conf

Do not use sudo usbguard generate-policy > /etc/usbguard/rules.conf as a shortcut. The shell opens and truncates the destination before sudo runs, so the redirection itself does not gain root privileges. The reviewed-file workflow above avoids that problem and gives you a chance to inspect the policy first.

Remove a rule

List the policy rules and identify the rule ID of the entry you want to remove:

$ sudo usbguard list-rules

Remove that rule using its rule ID:

$ sudo usbguard remove-rule RULE_ID

Replace RULE_ID with the rule number from list-rules. Rule IDs are different from the internal device IDs shown by list-devices.

To see which devices are affected by policy rules, use:

$ sudo usbguard list-rules --show-devices

After removing a rule, a device may fall back to the implicit policy, commonly blocking it. Check the device state after the change:

$ sudo usbguard list-devices

Check logs and troubleshoot

Review USBGuard service logs with:

$ sudo journalctl -u usbguard.service

If a keyboard, mouse, or drive is blocked:

1. Run sudo usbguard list-devices and find its internal device ID.
2. Temporarily allow it with sudo usbguard allow-device DEVICE_ID.
3. If you intend to keep it authorized, make the decision permanent or add a carefully matched rule.
4. Check the active policy with sudo usbguard list-rules.

Replace DEVICE_ID with the number at the beginning of the device's entry. If USBGuard blocks the input devices you need, use another access method, such as SSH or a local recovery console, to adjust the policy.

USBGuard best practices

• Generate and review the initial policy before starting the daemon.
• Back up /etc/usbguard/rules.conf before editing it.
• Permanently allow only devices you have verified and intend to trust.
• Use specific matching attributes when authorizing one physical device; a vendor:product ID alone may match multiple units.
• Treat device names and serial numbers as identifying hints, not strong authentication.
• Check your distribution's daemon configuration because the default behavior can vary.
• Review service logs when investigating unexpected device events.

USBGuard adds a useful layer of control over USB device authorization on Linux. Set it up carefully: overly broad rules can authorize more devices than intended, while missing rules can block devices you rely on.

Documentation references

• USBGuard project and first-start guidance
• USBGuard command-line manual
• USBGuard rule language
• USBGuard rules file manual

USBGuard gives Linux users a practical way to control which USB devices can interact with their systems. Start with a reviewed policy that keeps essential devices working, then add specific rules for trusted devices and check the active policy after changes. Careful setup helps reduce unwanted USB access without locking you out of the devices you need.