Install usbguard Package
Ensures the usbguard USB device authorization framework is installed.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
usbguard is a framework that protects against rogue USB devices by implementing allow-listing / block-listing based on USB device attributes. Without it, any USB device plugged into the host is accepted by the kernel, enabling attacks such as malicious HID injection (BadUSB / Rubber Ducky), data exfiltration via mass-storage, or rogue network adapters that redirect traffic. Installing usbguard gives you a policy enforcement point so that only explicitly authorized devices are allowed.
What Pavois checks
Pavois verifies presence through the InSpec package('usbguard') resource (backed by rpm -q usbguard). This is a prerequisite check: the package must exist before any policy can be loaded. Note that installing usbguard alone is not protective until a rule set is generated (usbguard generate-policy) and the service is enabled, Pavois treats the package as the baseline gate.
describe package('usbguard') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q usbguard. Expected output: a versioned package name such as usbguard-1.0.0-.... To confirm enforcement is active, also check systemctl is-active usbguard returns active and usbguard list-rules shows your policy.
Inspect & investigate
- Package state:
rpm -q usbguard, transactions in/var/log/dnf.rpm.log. - Device authorization decisions and policy events:
journalctl -u usbguard(allowed/blocked devices are logged here).
Remediation
Pavois's harden plan declares a package resource for usbguard with action install, so pavois harden apply installs it (dnf install usbguard). The plan installs the package only; you must still generate an initial policy with usbguard generate-policy and enable the service so legitimate devices keep working.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | usbguard |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without usbguard the host accepts any USB device, leaving it exposed to BadUSB-class attacks and unauthorized storage/network devices. Before enabling enforcement (precaution against lockout): generate the policy while the devices you need (keyboard, mouse, KVM, smartcard readers) are connected, otherwise enabling the service can block your own input devices, on a remote server this is harmless (USB input is irrelevant over SSH), but on a console-managed machine it can lock out local administration. Installing the package alone, as this rule does, is non-disruptive.