To achieve that, edit the USBGuard configuration at `/etc/usbguard/usbguard-daemon.conf` to include the
following lines:
```
#reject all devices by default
ImplicitPolicyTarget=reject
#allow all devices that are available at boot time
PresentDevicePolicy=allow
PresentControllerPolicy=allow
```
The policy itself at `/etc/usbguard/rules.conf` would have to look as follows:
```
############ REJECT #################
#only let certain interfaces pass to our default policy and block all others
#generate via bash: seq 0 255 | while read -r i ; do printf '%.2X:*:* ' "$i" ; done
#NOTE: reject *:* with-interface none-of { allowed ones } wouldn't work precisely as a malicious device could just add an interface of the allowed types _in addition_ to its unwanted interface types to pass
# You may want to add your devices here for convenience, but it's not absolutely necessary if you use the provided script to temporarily allow new devices.
#NOTE: the one-ofs are workarounds for https://github.com/USBGuard/usbguard/issues/207
# Since we filter out everything else above, one-of should be fine.
#USB hubs (some internal)
#allow id xxxx:xxxx with-interface one-of { 09:*:* }
#mouse & keyboard
#allow id xxxx:xxxx with-interface one-of { 03:*:* }
#external sound card
#allow id xxxx:xxxx with-interface one-of { 01:*:* }
#hard disks
#allow id xxxx:xxxx with-interface one-of { 08:*:* }
#smart cards
#allow id xxxx:xxxx with-interface one-of { 0B:*:* }
########### DEFAULT #################
#Everything connected during service startup will otherwise be allowed in this configuration.
#Everything connected later will be rejected.
```
Please note that misconfigurations to the `usbguard` configuration may make the respective USB devices
temporarily unusable on your host. The log file available at `/var/log/usbguard/usbguard.log` may help
to investigate issues.
At the end of the configuration, you may have to restart the service via `systemctl restart usbguard`.
Also make sure that it is enabled at boot time via `systemctl enable usbguard`.
#### Script to temporarily allow new devices
To temporarily allow new devices for 60 seconds, you can e.g. use the following script:
```bash
#!/bin/bash
#
# Temporarily allow new USB devices.
#
# Assumes ImplicitPolicyTarget=reject in the default configuration.
