Peripherals

USB sticks and gadgets

Keep locked A stick that enumerates as a keyboard is a real attack. The standard is USBGuard: generate a policy from what is plugged in now, block new IDs until you allow them.

  1. Plug in what you actually use

    Keyboard, mouse, YubiKey, the disk you trust. Unplug novelty gadgets and random charging dongles.

  2. Write the policy (optional)

    Unwoke setup → USBGuard (default No). We ask after login, not on a black tty before GNOME. Default stays No. If you want the policy:

    ujust setup-usbguard

    Stock recipe. Allows currently attached devices and enables the daemon. After that, a new stick may do nothing until you allow it — that is success.

  3. New device later

    Follow their USBGuard notes (mirrored under their post-install). Do not disable USBGuard to “make USB work.” Do not use Ventoy on install media either — Install.