Peripherals
USB sticks and gadgets
Keep locked A stick that enumerates as a keyboard is a real attack. The standard is USBGuard: generate a policy from what is plugged in now, block new IDs until you allow them.
-
Plug in what you actually use
Keyboard, mouse, YubiKey, the disk you trust. Unplug novelty gadgets and random charging dongles.
-
Write the policy (optional)
Unwoke setup → USBGuard (default No). We ask after login, not on a black tty before GNOME. Default stays No. If you want the policy:
ujust setup-usbguardStock recipe. Allows currently attached devices and enables the daemon. After that, a new stick may do nothing until you allow it — that is success.
-
New device later
Follow their USBGuard notes (mirrored under their post-install). Do not disable USBGuard to “make USB work.” Do not use Ventoy on install media either — Install.