{"id":3383,"date":"2026-08-13T05:20:28","date_gmt":"2026-08-13T05:20:28","guid":{"rendered":"https:\/\/zecurit.com\/help\/endpoint-management\/device-access-control\/creating-a-linux-policy\/"},"modified":"2026-08-13T07:48:34","modified_gmt":"2026-08-13T07:48:34","slug":"creating-a-linux-policy","status":"publish","type":"docs","link":"https:\/\/zecurit.com\/help\/endpoint-management\/device-access-control\/creating-a-linux-policy\/","title":{"rendered":"Creating a Linux Policy"},"content":{"rendered":"\n

A Device Access Control<\/strong> policy controls access to USB and peripheral devices. For each device type, you can set the action to Allow, Block, or Not Configured<\/strong>. The selected settings are applied to all enrolled endpoints assigned to the profile.<\/p>\n\n\n\n

What is a Device Access Control Policy?<\/strong><\/h2>\n\n\n\n

A Device Access Control<\/strong> policy controls which USB and peripheral devices can be used on managed endpoints. Each device type, such as USB Storage Devices<\/strong> or Bluetooth Adapters<\/strong>, can be set to Allow, Block, or Not Configured<\/strong>. This lets you apply stricter controls to high-risk devices while allowing everyday peripherals, such as mice and keyboards.<\/p>\n\n\n\n

The same device type can have different settings in different profiles. For example, one profile can Block USB Storage Devices<\/strong> for most users, while another profile can Allow<\/strong> them for a specific IT support group.<\/p>\n\n\n\n

Create Policy<\/h2>\n\n\n\n
\"\"<\/figure>\n\n\n\n
    \n
  1. Log in to the Zecurit portal<\/strong>.<\/li>\n\n\n\n
  2. Go to Endpoint Manager \u2192 Manage \u2192 Profiles<\/strong>.<\/li>\n\n\n\n
  3. Click Create Profile<\/strong>, then select Linux<\/strong> as the platform.<\/li>\n\n\n\n
  4. Select Device Access Control<\/strong> from the configuration list.<\/li>\n\n\n\n
  5. Set an action, such as Allow, Block, or Not Configured<\/strong>, for each device type under High Risk Devices, Network & Communication,<\/strong> and Standard Peripherals<\/strong>.<\/li>\n\n\n\n
  6. Click Publish<\/strong> to activate the profile immediately, or Save as Draft<\/strong> to complete it later.<\/li>\n<\/ol>\n\n\n\n

    At least one device type must be set to Allow<\/strong> or Block<\/strong> for the profile to take effect. Device types set to Not Configured<\/strong> are not enforced by the profile.<\/p>\n\n\n\n

    Policy Details<\/h2>\n\n\n\n
    Field<\/strong><\/th>Required<\/strong><\/th>Description<\/strong><\/th><\/tr><\/thead>
    Profile Name<\/td>Yes<\/td>A descriptive name for the profile (e.g., “Standard Linux Endpoint Security”). Shown in Inventory to identify which profile is applied to a device.<\/td><\/tr>
    Platform<\/td>Yes<\/td>Must be set to Linux. Device categories and available actions are the same across platforms, but a profile only applies to endpoints matching its selected platform.<\/td><\/tr>
    Device Type Actions<\/td>Yes<\/td>The Allow \/ Block \/ Not Configured setting chosen for each device type listed under the profile’s categories.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    A single profile can set Block on some device types and Allow on others. There is no requirement to apply the same action across an entire category.<\/p>\n\n\n\n

    Device Categories and Actions<\/h2>\n\n\n\n

    Each device type uses one of three actions:<\/p>\n\n\n\n

    Action<\/strong><\/th>Effect<\/strong><\/th>Best For<\/strong><\/th><\/tr><\/thead>
    Allow<\/td>The device is permitted and functions normally.<\/td>Everyday peripherals required for business use, such as mice, keyboards, and printers.<\/td><\/tr>
    Block<\/td>The device is denied; the endpoint prevents it from mounting or being used.<\/td>High-risk device types where there is no legitimate business need, such as USB storage or optical media.<\/td><\/tr>
    Not Configured<\/td>No rule is applied by this profile; the device follows local settings or another assigned profile.<\/td>Device types intentionally left to a different, more specific profile or to local policy.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    Device types are grouped into three categories to make large policies easier to review:<\/p>\n\n\n\n

    Category<\/strong><\/th>Includes<\/strong><\/th><\/tr><\/thead>
    High Risk Devices<\/td>USB Storage Devices, CD\/DVD Drives, External Hard Drives, Mobile Devices (MTP\/PTP), Imaging Devices<\/td><\/tr>
    Network & Communication<\/td>Wireless Adapters, Bluetooth Adapters, Modems<\/td><\/tr>
    Standard Peripherals<\/td>Mice, Keyboards, Printers, Smart Card Readers, Serial Ports<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    A typical rollout pattern is to leave a new device type on Not Configured while confirming which endpoints actually use it, then move to Block once you’ve confirmed it has no legitimate business use in your environment.<\/p>\n\n\n\n

    Publishing vs. Saving as Draft<\/strong><\/h1>\n\n\n\n
    Option<\/strong><\/th>Effect<\/strong><\/th><\/tr><\/thead>
    Publish<\/td>Activates the policy immediately; enforcement begins on all Linux endpoints the profile is assigned to.<\/td><\/tr>
    Save as Draft<\/td>Stores the profile configuration without activating it, so it can be reviewed or completed later.<\/td><\/tr>
    Cancel<\/td>Discards changes and exits without saving.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    Example Policies<\/h2>\n\n\n\n
    Profile Name<\/strong><\/th>Category Focus<\/strong><\/th>Action<\/strong><\/th>Notes<\/strong><\/th><\/tr><\/thead>
    Standard Linux Endpoint Security<\/td>High Risk Devices<\/td>Block<\/td>Applied to all Linux workstations and servers.<\/td><\/tr>
    Linux Kiosk Lockdown<\/td>High Risk + Network & Communication<\/td>Block<\/td>Applied to shared\/kiosk Linux device group only.<\/td><\/tr>
    IT Support Exception<\/td>High Risk Devices<\/td>Allow<\/td>Scoped to the Linux IT support device group only.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    Best Practices<\/h2>\n\n\n\n
      \n
    • Name profiles clearly enough that they’re identifiable later in Inventory without opening them.<\/li>\n\n\n\n
    • Set high-risk device types (USB storage, optical media, external drives) to Block by default.<\/li>\n\n\n\n
    • Keep everyday peripherals mice, keyboards, printers on Allow.<\/li>\n\n\n\n
    • Use a separate, narrowly scoped profile for exceptions rather than loosening the base policy.<\/li>\n\n\n\n
    • Review published profiles periodically, since device usage and risk levels change over time.<\/li>\n<\/ul>\n\n\n\n

      Troubleshooting Tips<\/h2>\n\n\n\n
      Issue<\/strong><\/th>Resolution<\/strong><\/th><\/tr><\/thead>
      Publish button is disabled<\/td>Confirm a Profile Name is entered, Platform is set to Linux, and at least one device type has an action set.<\/td><\/tr>
      Device blocked unexpectedly<\/td>Check whether another assigned profile also sets a policy for that device type; Block generally takes precedence over Allow.<\/td><\/tr>
      User reports device still works after Block<\/td>Confirm the profile was Published, not left as a draft, and that the device has synced with the endpoint.<\/td><\/tr>
      Draft profile not enforcing<\/td>Draft profiles are inactive by design; open the profile and click Publish to activate it.<\/td><\/tr>
      Policy created for Linux not applying to a device<\/td>Confirm the target device’s platform is Linux; a profile only applies to endpoints matching its selected platform.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

      <\/h1>\n\n\n\n

      <\/p>\n","protected":false},"featured_media":0,"parent":3334,"menu_order":1,"comment_status":"open","ping_status":"closed","template":"","meta":{"_is_vendor_doc":"0","footnotes":""},"doc_tag":[],"class_list":["post-3383","docs","type-docs","status-publish","hentry"],"comment_count":0,"_links":{"self":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3383","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/types\/docs"}],"replies":[{"embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/comments?post=3383"}],"version-history":[{"count":4,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3383\/revisions"}],"predecessor-version":[{"id":3426,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3383\/revisions\/3426"}],"up":[{"embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3334"}],"next":[{"title":"Associate Groups and Devices","link":"https:\/\/zecurit.com\/help\/endpoint-management\/device-access-control\/associate-groups-and-devices\/","href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3360"}],"prev":[{"title":"Creating a Windows Policy","link":"https:\/\/zecurit.com\/help\/endpoint-management\/device-access-control\/creating-a-windows-policy\/","href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3351"}],"wp:attachment":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/media?parent=3383"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/doc_tag?post=3383"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}