{"id":506816,"date":"2025-08-08T05:04:12","date_gmt":"2025-08-08T05:04:12","guid":{"rendered":"https:\/\/www.ninjaone.com\/?post_type=script_hub&p=506816"},"modified":"2025-08-08T05:04:51","modified_gmt":"2025-08-08T05:04:51","slug":"controllare-lo-stato-dello-storage-usb-in-linux-usando-lo-scripting-shell","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/it\/script-hub\/controllare-lo-stato-dello-storage-usb-in-linux-usando-lo-scripting-shell\/","title":{"rendered":"Come controllare lo stato dello storage USB in Linux utilizzando lo scripting shell"},"content":{"rendered":"

I dispositivi di archiviazione rimovibili come le unit\u00e0 USB sono strumenti indispensabili per il trasferimento dei dati, i backup e il ripristino del sistema. Tuttavia, se non gestiti, rappresentano anche un grave rischio per la sicurezza, soprattutto in ambienti enterprise o MSP. Sapere se l’accesso allo storage USB \u00e8 abilitato sui tuoi sistemi Linux non \u00e8 solo una questione di convenienza; \u00e8 una questione di applicazione delle criteri, di conformit\u00e0 alla sicurezza e di consapevolezza operativa. In questo articolo analizzeremo uno script in shell che automatizza il processo di verifica dello stato dello storage USB in Linux e che si integra facoltativamente con NinjaOne per inserire i risultati in un report.<\/p>\n

Contesto<\/h2>\n

In Linux, il controllo dell’accesso allo storage USB \u00e8 gestito principalmente dai moduli del kernel, in particolare dai driver usb_storage<\/strong> e uas<\/strong> (USB Attached SCSI). Gli amministratori di sistema possono disabilitare questi driver inserendoli nella lista nera o configurandoli in modo che eseguano comandi innocui invece di essere caricati.<\/p>\n

Lo script qui esaminato per controllare lo stato dello storage USB in Linux \u00e8 progettato per ispezionare la directory \/etc\/modprobe.d<\/strong>, dove di solito risiedono queste regole di caricamento dei moduli. \u00c8 particolarmente importante negli ambienti gestiti tramite NinjaOne, dove la supervisione centralizzata e i controlli di conformit\u00e0 automatizzati sono essenziali. I provider di servizi gestiti (MSP)<\/a> e i team IT interni traggono vantaggio da questo tipo di strumenti per garantire che gli endpoint siano conformi ai criteri aziendali.<\/p>\n

Lo script per controllare lo stato dello storage USB in Linux:<\/h2>\n
#!\/usr\/bin\/env bash\r\n\r\n# Description: Checks if the linux machine currently allows access to USB storage devices and optionally saves the results to a custom field.\r\n# By using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n# Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n# Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n# Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n# Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n# Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n# Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n# EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#\r\n#   The script checks the modprobe.d folder for any files that may block the USB storage driver or the USB Attached SCSI driver.\r\n#   There are two methods of loading USB storage drivers that allow mounting of USB storage devices:\r\n#       1. Implicit loading: The USB storage driver is loaded automatically when a USB storage device is connected.\r\n#       2. Explicit loading: The USB storage driver is loaded manually by a user, program, or script.\r\n#\r\n# Release Notes: Initial Release\r\n#\r\n# Preset Parameter: -CustomField \"usbStorageStatus\"\r\n#   The custom field to save the USB storage status to.\r\n#\r\n# Preset Parameter: --help\r\n#   Displays the help menu.\r\n#\r\n\r\n# Functions\r\n# Print an error message and exit with a specific status code\r\ndie() {\r\n    local _ret=\"${2:-1}\"\r\n    test \"${_PRINT_HELP:-no}\" = yes && print_help >&2\r\n    echo \"$1\" >&2\r\n    exit \"${_ret}\"\r\n}\r\n\r\nprint_help() {\r\n    printf '\\n\\n%s\\n\\n' 'Usage: [-CustomField \"custom_field_name\"]'\r\n    printf '  %s\\n' '-CustomField'\r\n    printf '    The custom field to save the USB storage status to.\\n'\r\n}\r\n\r\n# Parse the command-line arguments\r\nparse_commandline() {\r\n    while test $# -gt 0; do\r\n        _key=\"$1\"\r\n        case \"$_key\" in\r\n        -CustomField | --CustomField | -customfield | --customfield | -cf | --cf)\r\n            _arg_customfield=\"CustomField\"\r\n            ;;\r\n        --help | -help | -h | --h)\r\n            _PRINT_HELP=yes die \"\" 0\r\n            ;;\r\n        *)\r\n            _PRINT_HELP=yes die \"[Error] Got an unexpected argument '$1'\" 1\r\n            ;;\r\n        esac\r\n        shift\r\n    done\r\n}\r\n\r\nfunction SetCustomField() {\r\n    if [[ -z \"$1\" ]] || [[ -z \"$2\" ]]; then\r\n        echo \"[Error] Missing required arguments.\"\r\n        return 1\r\n    fi\r\n    local customfieldName=$1\r\n    local customfieldValue=$2\r\n    if [ -f \"${NINJA_DATA_PATH}\/ninjarmm-cli\" ]; then\r\n        if [ -x \"${NINJA_DATA_PATH}\/ninjarmm-cli\" ]; then\r\n            if \"$NINJA_DATA_PATH\"\/ninjarmm-cli get \"$customfieldName\" >\/dev\/null; then\r\n                # check if the value is greater than 10000 characters\r\n                if [ ${#customfieldValue} -gt 10000 ]; then\r\n                    echo \"[Warn] Custom field value is greater than 10000 characters\" >&2\r\n                    return 1\r\n                fi\r\n                if ! echo \"${customfieldValue::10000}\" | \"$NINJA_DATA_PATH\"\/ninjarmm-cli set --stdin \"$customfieldName\"; then\r\n                    echo \"[Warn] Failed to set custom field\" >&2\r\n                    return 1\r\n                else\r\n                    echo \"[Info] Custom field value set successfully\"\r\n                fi\r\n            else\r\n                echo \"[Warn] Custom Field ($customfieldName) does not exist or agent does not have permission to access it\" >&2\r\n                return 1\r\n            fi\r\n        else\r\n            echo \"[Warn] ninjarmm-cli is not executable\" >&2\r\n            return 1\r\n        fi\r\n    else\r\n        echo \"[Warn] ninjarmm-cli does not exist\" >&2\r\n        return 1\r\n    fi\r\n}\r\n\r\nparse_commandline \"$@\"\r\n\r\n# If script form variables are used, replace the command line parameters with their value.\r\nif [[ -n \"${customField}\" ]]; then\r\n    _arg_customfield=\"${customField}\"\r\nfi\r\n\r\n# Variables\r\n# Modprobe.d folder\r\nmodprobFolder=\"\/etc\/modprobe.d\"\r\n\r\n# Check if we have read access to the modprobe.d folder\r\nif ! [ -r \"${modprobFolder}\" ]; then\r\n    if [[ -n \"${_arg_customfield}\" ]]; then\r\n        SetCustomField \"${_arg_customfield}\" \"Unable to Determine\"\r\n    fi\r\n    die \"[Error] User ${USER} has no read access to modprobe.d folder\" 1\r\nfi\r\n\r\n# Check if modprobe.d folder does not exist\r\nif ! [ -d \"${modprobFolder}\" ]; then\r\n    if [[ -n \"${_arg_customfield}\" ]]; then\r\n        SetCustomField \"${_arg_customfield}\" \"Unable to Determine\"\r\n    fi\r\n    die \"[Error] Modprobe folder does not exist\" 1\r\nfi\r\n\r\n# Set default values\r\nUsbStorage=\"Enabled\"\r\nusb_storage_status=\"Enabled\"\r\nuas_status=\"Enabled\"\r\nusb_storage_driver_status=\"Enabled\"\r\nuas_driver_status=\"Enabled\"\r\n\r\n# Check if usb_storage or uas is blocked in other files\r\nfor file in \"${modprobFolder}\"\/*; do\r\n\r\n    if ! [ -r \"${file}\" ]; then\r\n        echo \"[Warn] User ${USER} has no read access to ${file}\"\r\n    fi\r\n\r\n    # Check if implicit loading is blocked\r\n    if grep -q \"blacklist usb_storage\" \"${file}\"; then\r\n        echo \"[Info] USB storage driver is blocked in ${file}\"\r\n        usb_storage_status=\"Disabled\"\r\n    fi\r\n    # Check if implicit loading is blocked\r\n    if grep -q \"blacklist uas\" \"${file}\"; then\r\n        echo \"[Info] USB Attached SCSI driver is blocked in ${file}\"\r\n        uas_status=\"Disabled\"\r\n    fi\r\n\r\n    # Check if explicit loading is blocked\r\n    if grep -q \"install usb-storage \/bin\/true\" \"${file}\"; then\r\n        echo \"[Info] USB storage driver is blocked in ${file}\"\r\n        usb_storage_driver_status=\"Disabled\"\r\n    fi\r\n    # Check if explicit loading is blocked\r\n    if grep -q \"install uas \/bin\/true\" \"${file}\"; then\r\n        echo \"[Info] USB Attached SCSI driver is blocked in ${file}\"\r\n        uas_driver_status=\"Disabled\"\r\n    fi\r\ndone\r\n\r\n# Output the status of implicit loading\r\nif [ \"${usb_storage_status}\" == \"Disabled\" ] && [ \"${uas_status}\" == \"Disabled\" ]; then\r\n    echo \"[Info] USB storage driver implicit loading: Blocked\"\r\nelif [ \"${usb_storage_status}\" == \"Enabled\" ] && [ \"${uas_status}\" == \"Enabled\" ]; then\r\n    echo \"[Info] USB storage driver implicit loading: Allowed\"\r\nelse\r\n    echo \"[Info] USB storage driver implicit loading: Partially Allowed\"\r\nfi\r\n\r\n# Output the status of explicit loading\r\nif [ \"${usb_storage_driver_status}\" == \"Disabled\" ] && [ \"${uas_driver_status}\" == \"Disabled\" ]; then\r\n    echo \"[Info] USB storage driver manual loading: Blocked\"\r\nelif [ \"${usb_storage_driver_status}\" == \"Enabled\" ] && [ \"${uas_driver_status}\" == \"Enabled\" ]; then\r\n    echo \"[Info] USB storage driver manual loading: Allowed\"\r\nelse\r\n    echo \"[Info] USB storage driver manual loading: Partially Allowed\"\r\nfi\r\n\r\n# Determine the overall status of USB storage\r\nif [ \"${usb_storage_status}\" == \"Disabled\" ] && [ \"${uas_status}\" == \"Disabled\" ] && [ \"${usb_storage_driver_status}\" == \"Disabled\" ] && [ \"${uas_driver_status}\" == \"Disabled\" ]; then\r\n    UsbStorage=\"Disabled\"\r\nelif [ \"${usb_storage_status}\" == \"Enabled\" ] && [ \"${uas_status}\" == \"Enabled\" ] && [ \"${usb_storage_driver_status}\" == \"Enabled\" ] && [ \"${uas_driver_status}\" == \"Enabled\" ]; then\r\n    UsbStorage=\"Enabled\"\r\nelif [ \"${usb_storage_status}\" == \"Enabled\" ] || [ \"${uas_status}\" == \"Enabled\" ] || [ \"${usb_storage_driver_status}\" == \"Enabled\" ] || [ \"${uas_driver_status}\" == \"Enabled\" ]; then\r\n    UsbStorage=\"Partially Allowed\"\r\nelse\r\n    UsbStorage=\"Unable to Determine\"\r\nfi\r\n\r\necho \"[Info] USB storage is ${UsbStorage}\"\r\n\r\nif [[ -n \"${_arg_customfield}\" ]]; then\r\n    SetCustomField \"${_arg_customfield}\" \"${UsbStorage}\"\r\nfi<\/pre>\n
 <\/p>\n\n
Analisi dettagliata dello script per controllare lo stato dello storage USB in Linux<\/h2>\n
Questo script shell per controllare lo stato dello storage USB in Linux esegue diverse operazioni in modo strutturato e con tolleranza ai malfunzionamenti. Ecco una spiegazione passo per passo:<\/p>\n
    \n
  1. \n
    Parsing<\/strong> degli argomenti della riga di comando<\/h3>\n