6

How can I disable the auto mount of usb/firewire devices or basically any external disk in MacOSX?

My motivation for this is that in Windows there have been possible attacks via USB trojans that would copy to the internal hard drive just after the auto mount. I thought that disabling auto mount of external devices is a good counter measure. But I'm be open to solutions that protect from such a threat using other methods.

Edit

I assume that a solution to my problem would have to look like the following:

  1. Auto mount disabled for all devices.
  2. Opt-in of auto mount for my private devices.
Improve this question
2
  • Here is a Quora answer describing the procedure.
    – Alex
    Commented Feb 5, 2012 at 12:49
  • @Alex Thanks for the link. Unfortunately, this is not sufficient. You need the specific UUID of the external device that you want to disable auto mount for. The solution I need would have to do the opposite: 1) Auto mount disabled for all devices. 2) Opt-in of auto mount for my private devices.
    – gentmatt
    Commented Feb 5, 2012 at 12:58

3 Answers 3

Reset to default
9

You should be able to use Disk Arbitrator to do most of what you want. Certainly requirement 1 is met and you should be able to achieve most of 2 with it too.

Improve this answer
2

As far as I know, such attacks rely on the auto-run feature, not the auto-mount feature, meaning that even manually mounting a disk will trigger the auto-run program.

However, OS X doesn't support auto-run at all, so even if a volume auto-mounts and it does have a trojan on it, the trojan will not start automatically.

Improve this answer
2
  • Re "even manually mounting a disk"; You can reformat it without mounting.
    – Pacerier
    Commented Mar 6, 2018 at 9:32
  • OS X definitely auto-runs some stuff when it detects a connection.
    – Pacerier
    Commented Mar 6, 2018 at 9:33
1

This is how I disable auto mounting of APFS volumes on macOS Catalina.

For macOS volumes, both Macintosh HD - Data and Macintosh HD type volumes need to be referenced in /etc/fstab.

Find volume(s) using diskutil list and set VOLUME_PATH accordingly.

# Disable auto mounting of "macOS - Data" volume
VOLUME_PATH="/Volumes/macOS - Data"
VOLUME_UUID=`diskutil info "$VOLUME_PATH" | awk '/Volume UUID:/ { print $3 }'`
cat << EOF | sudo tee -a /etc/fstab
UUID=$VOLUME_UUID none apfs rw,noauto
EOF

# Disable auto mounting of "macOS" volume
VOLUME_PATH="/Volumes/macOS"
VOLUME_UUID=`diskutil info "$VOLUME_PATH" | awk '/Volume UUID:/ { print $3 }'`
cat << EOF | sudo tee -a /etc/fstab
UUID=$VOLUME_UUID none apfs rw,noauto
EOF

Here is what is going when running above commands:

Set VOLUME_PATH variable to /Volumes/macOS - Data

VOLUME_PATH="/Volumes/macOS - Data"

Set VOLUME_UUID variable to volume UUID of /Volumes/macOS - Data volume

Running diskutil info "$VOLUME_PATH" outputs volume details of /Volumes/macOS - Data (which includes its UUID).

Piping (|) these details to awk '/Volume UUID:/ { print $3 }' extracts the UUID.

VOLUME_UUID=`diskutil info "$VOLUME_PATH" | awk '/Volume UUID:/ { print $3 }'`

Append UUID=$VOLUME_UUID none apfs rw,noauto to /etc/fstab and output to console (see tee)

cat << EOF | sudo tee -a /etc/fstab
UUID=$VOLUME_UUID none apfs rw,noauto
EOF
Improve this answer
1
  • Thanks for sharing, didn’t know about this syntax.
    – sunknudsen
    Commented Aug 12, 2020 at 15:07

Not the answer you're looking for? Browse other questions tagged .