Hacker News Reader

Comment by AdmiralAsshat | Hacker News Reader

USB/IP is a project that provides a general USB device sharing system over IP network. To share USB devices between computers with their full functionality, USB/IP encapsulates "USB I/O messages" into TCP/IP payloads and transmits them between computer. Original USB device drivers and applications can be also used for remote USB devices without any modification of them. A computer can use remote USB devices as if they were directly attached.

Considering the recent BadUSB exploits that have come to light, is this really something we want? It just seems like the risk could outweigh the benefit.

View on HN

It would normally be implemented as kernel modules (usbip.ko, usbip-host.ko) and those would not be autoloaded on device recognition, because who knows whether a given device wants them? So they would be loaded when a userspace tool calls for them.

The protocol uses port 3240 by default, and so you can disable it with a firewall at either end or in between. Though I think this really calls for an encrypted path and some sort of identification and authentication.

Since this needs to be enabled in the kernel at compile time, it really depends on what your favorite distribution chooses to include.

If it does end up being in the Big Two (Debian-flavored, RH-flavored) it really doesn't make sense for servers. If it was enabled by default this seems like something that you would need to do some sort of 'handshake' between to prevent someone from just mounting a USB device willy-nilly as they see fit. Complete speculation on my part though.

It absolutely does make sense for servers. One frequent pain point with virtualized systems is that (at least in a VMware vCenter DRS-enabled cluster), you never know what physical host a specific VM will be on at any moment. This is a problem for software that requires a USB license dongle (many FlexLM-managed software have this requirement).

Anyway, in this situation, you would have one physical, bare-metal linux "usb dongle server", which then shares out its USB devices to one or more other linux VMs. After doing this, VMs can migrate between physical hosts without losing access to their license dongle.

There are purpose-built physical USB->IP devices out out there now, but they're quite expensive. This new functionality would allow admins to emulate this functionality for a fraction of the cost of a purpose-built device.

Ah, that's a use case I didn't even think of. Makes sense in that situation then. I rarely deal with things that require USB license dongles, but I can see that as being a pain this may alleviate.

Why were you downvoted?

Reply on news.ycombinator.com