Enable the USBGuard Service
Ensures usbguard.service is enabled and running so the USB device authorization policy is enforced.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Why this rule matters
The usbguard service must be running to enforce the USB device authorization policy that whitelists which USB devices may attach to the system. Without it, any USB device plugged in is accepted, exposing the host to BadUSB attacks, rogue keyboards/network adapters that inject keystrokes or hijack traffic, and data exfiltration via mass-storage. Enforcing a device policy is a key physical-access control for endpoints and servers in accessible locations.
What Pavois checks
Pavois reads the effective unit state via service('usbguard.service') (systemctl is-enabled / is-active). This confirms the daemon is actually enforcing now and at boot, including drop-in overrides, rather than just that a rules file /etc/usbguard/rules.conf exists. A present ruleset with a stopped daemon enforces nothing; only effective-state checking exposes that gap.
describe service('usbguard.service') do
it { should be_enabled }
it { should be_running }
endHow to verify it is applied
Run systemctl is-enabled usbguard && systemctl is-active usbguard (expect enabled then active). Confirm the policy is loaded with usbguard list-rules (should list your authorized devices) and usbguard list-devices (shows allowed/blocked state).
Inspect & investigate
Daemon health and policy decisions are in journalctl -u usbguard.service; device authorization/blocking events are logged there and via the audit subsystem (/var/log/audit/audit.log). usbguard list-devices shows the current allowed/blocked verdict per device.
Remediation
Pavois's harden plan acts on the service resource named usbguard: it runs enable and start so the policy is enforced at boot and immediately. It is applied with pavois harden apply. USBGuard must be installed and an initial allow policy generated first (usbguard generate-policy > /etc/usbguard/rules.conf), otherwise starting the daemon with an empty/implicit-block policy can reject currently attached devices.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | enable, start |
|---|---|
| name | usbguard.service |
| resource | service |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
The biggest risk is locking out essential USB hardware: if you enable USBGuard with a default-block policy, an attached USB keyboard, KVM, or boot device can be blocked, leaving a server unmanageable. Precautions: generate the baseline policy from the currently connected, trusted devices before starting the service; review usbguard list-rules; on remote/headless hosts ensure you still have non-USB access (network SSH, serial/iLO console) in case an input device is rejected; and keep ImplicitPolicyTarget set deliberately.