How to block all USB except one port?

Question

USB

Is it possible to block all usb except one port? The option of using certain flash drives is also being considered.

Answer 1

cut out physically. the military does it.
they rip out the ports, directly connect the mouse with the keyboard and fill it with epoxy. and seal the body.
var2: completely hide the computer in an iron box under lock and key.
cheap and serious, the opening is seen clearly.

Answer 2

The main reason why your idea doesn't make sense is that the user will bring the hub and get as many ports as they want. And if the user is cunning, he will hide the hub and flash drive inside the mouse / keyboard .
1) No, the USB ports are internally connected to a hub chip, which in 99% of cases is stupid and not controlled in any way.
2) If different hubs are installed in the machine (for example, old motherboards have a separate usb 3.0 hub), then yes, you can turn it off in the device manager and disable the ports associated with it.
So there are physical methods of disconnection - just do not push anything into the connectors. The ports on the front panel can be disabled by unplugging them from the motherboard. On the rear panel - you can order laser-cut strips for connectors without corresponding holes.
3) There are all sorts of different programs that filter flash drives according to different criteria, both for the window and for Linux. On Linux, it is enough to conjure with the rules of udev.

Answer 3

AD policy + KES policy + prohibition in BIOS to boot from anything other than HDD + BIOS password + sticker seal on the cover of the system unit
Well, a couple of orders against signature that you can’t use flash drives and what will happen with quarterly monitoring of logs.