PowerVM

Power Virtualization

Learn about the virtualization technologies designed specifically for IBM Power including #PowerVM, #PowerVC, #VM Recovery Manager, #HCM/CMC, and more.


#Power
#TechXchangeConferenceLab

 View Only
Back to discussions
Expand all | Collapse all

Disabling USB port in Power HW / HMC

  • 1.  Disabling USB port in Power HW / HMC

    Posted Wed February 23, 2022 06:27 AM
    Hi,

    Bumped into curious thing in one security audit.

    Auditors requested evidence for "Restrict physical ports (for example, USB) as appropriate"

    To be honest, I am not really sure what to answer on that one yet; I know USB ports are seen on HMC as standard IO adapters, but never before needed even
    to consider how to disable those.

    Any ideas? Or any official statement in documentation saying something about USB ports in Power? :-)

    Br,
    tommi
     


    ------------------------------
    Tommi Sihvo, Lead Service Architect
    TietoEVRY, Compute Services
    email tommi.sihvo@tietoevry.com mobile +358 (0)40 5180 Finland
    ------------------------------

    #PowerVM


  • 2.  RE: Disabling USB port in Power HW / HMC

    Posted Wed February 23, 2022 09:17 AM

    Hello,
    This should help you.
    From the ASMI menu log in as the admin user, then expand the System Configuration menu, expand Security and select USB Policy.  From here you can enable or disable USB access on the FSP and on the CEC.



    Regards,
    Douglas


    Douglas Gibbs
    IO Product Manager, IBM Cognitive Systems
    IBM Canada Ltd.
    905-413-5334

    "Tommi Sihvo via IBM Community" ---02/23/2022 06:27:31 AM---Hi, Bumped into curious thing in one security audit.






  • 3.  RE: Disabling USB port in Power HW / HMC

    Posted Thu February 24, 2022 02:55 AM
    Excellent!

    This is exactly what I was looking for, Many Thanks Douglas! :)

    Br,
    tommi

    ------------------------------
    Tommi Sihvo, Lead Service Architect
    TietoEVRY, Compute Services
    email tommi.sihvo@tietoevry.com mobile +358 (0)40 5180 Finland
    ------------------------------

    Original Message


  • 4.  RE: Disabling USB port in Power HW / HMC

    Posted Thu February 24, 2022 08:33 AM

    Hello
    we cannot find a way to disable USB on P8 .
    Where can i disable USB on P8 machines e.g. E880 ?

    Thx
    vince



    ------------------------------
    Vincencio Michaelis
    ------------------------------

    Original Message


  • 5.  RE: Disabling USB port in Power HW / HMC

    Posted Thu February 24, 2022 08:55 AM
    On Thu, Feb 24, 2022 at 01:32:55PM +0000, Vincencio Michaelis via IBM Community wrote:
    > we cannot find a way to disable USB on P8 .
    > Where can i disable USB on P8 machines e.g. E880 ?

    Don't assign the USB controller to any LPAR.

    Once that's done, the only other vector would be the firmware update
    that can be performed by USB. Please share if you find a way to
    disable that.

    Would a locked cabinet answer their question?

    ------------------------------------------------------------------
    Russell Adams Russell.Adams@AdamsSystems.nl
    Principal Consultant Adams Systems Consultancy
    http://adamssystems.nl/


    Original Message


  • 6.  RE: Disabling USB port in Power HW / HMC

    Posted Thu February 24, 2022 08:57 AM
    hi
    i know not to assign to a partition but this is not clsoing my security risc here...i want to disable simply by firmware FSP

    ------------------------------
    Vincencio Michaelis
    ------------------------------

    Original Message


  • 7.  RE: Disabling USB port in Power HW / HMC

    Posted Thu February 24, 2022 09:05 AM
    On Thu, Feb 24, 2022 at 01:57:26PM +0000, Vincencio Michaelis via IBM Community wrote:
    > i know not to assign to a partition but this is not clsoing my
    > security risc here...i want to disable simply by firmware FSP

    I'm trying to understand why this is a risk.

    POWER systems aren't a desktop running Windoze which can be infected
    by common viruses which might be written to random USB
    sticks. AIX/VIOs doesn't even read common filesystem types.

    The only security vector I can see is the USB firmware update
    option. That requires signed firmware files so it's a fairly low risk
    and exotic vector.

    Please let me know if you find a way to disable that. Perhaps there is
    an option in the FSP interface, because I've never seen anything on
    the HMC.

    ------------------------------------------------------------------
    Russell Adams Russell.Adams@AdamsSystems.nl
    Principal Consultant Adams Systems Consultancy
    http://adamssystems.nl/


    Original Message


  • 8.  RE: Disabling USB port in Power HW / HMC

    Posted Thu February 24, 2022 09:17 AM
    Russell
    the risc is a possability to use USB if you find a way to access/assign etc. it
    On P9 and P10 you can disable at ASMI over FSP this way:

    From the ASMI menu log in as the admin user, then expand the System Configuration menu, expand Security and select USB Policy.  From here you can enable or disable USB access on the FSP and on the CEC.

    ------------------------------
    Vincencio Michaelis
    ------------------------------

    Original Message


  • 9.  RE: Disabling USB port in Power HW / HMC

    Posted Thu February 24, 2022 03:56 PM

    The firmware option to disable USB is unique to the Power9 E980 because it has 2 physically integrated ports that cannot be removed (safely).  The Power8 and Power10 high end enterprise platforms have the option to only enable USB via a USB adapter so the most secure way to remove USB functionality is to pull the adapter from the system when it is not needed.  This may not be ideal and may cause support issues if the adapter is added and removed too frequently.  The next best option on Power8 and Power10 is to avoid assigning the adapter to any LPARs and only dynamically add and remove it.
    Regards,
    Douglas


    Douglas Gibbs
    IO Product Manager, IBM Cognitive Systems
    IBM Canada Ltd.
    905-413-5334

    "Vincencio Michaelis via IBM Community" ---02/24/2022 09:16:56 AM---Russell the risc is a possability to use USB if you find a way to access/assign etc. it




    Original Message


  • 10.  RE: Disabling USB port in Power HW / HMC

    Posted Fri February 25, 2022 06:20 AM

    > the risc is a possability to use USB if you find a way to access/assign etc...

    By the time you've managed to assign the USB to an LPAR, the USB is already the least of your problems.



    ------------------------------
    José Pina Coelho
    IT Specialist at Kyndryl
    ------------------------------

    Original Message


  • 11.  RE: Disabling USB port in Power HW / HMC

    Posted Tue October 21, 2025 09:36 AM

    :) so true



    ------------------------------
    Hashem Saad
    ------------------------------

    Original Message


  • 12.  RE: Disabling USB port in Power HW / HMC

    Posted Wed October 22, 2025 06:51 AM

    Hi!

    We had a similar question in a audit as well.  Our auditor was satisfied by the physical access restrictions of our data center, as you obviously can't plug something in, if you can't get into the data center.

    Best regards,

      Alexander



    ------------------------------
    Alexander Reichle-Schmehl
    ------------------------------



  • 13.  RE: Disabling USB port in Power HW / HMC

    Posted Mon October 27, 2025 08:27 AM

    I did some testing and P10 ASMI has the capability to disable the USB port as well. For systems that do not have it, aside from the already proposed solutions, I can suggest purchasing a USB port locker. There are many different options on the market. Usually it is a small cap for the usb port, that needs a key to be removed.

    Here a screenshot from the P10 ASMI option:



    ------------------------------
    Nikolay Banev
    ------------------------------

    Original Message


Related Content