0

Fresh DietPi install has bitcoin client and all sorts of unnecessary services installed. Which ones can I remove and how? The goal is to have a simple system can displays a website (needs to be able to fetch the new version when updated) that is secure from hackers. I plan to use nftables/firewalld for the security.

sudo firewall-cmd --get-services

RH-Satellite-6 amanda-client amanda-k5-client amqp amqps apcupsd audit bacula bacula-client bgp bitcoin bitcoin-rpc bitcoin-testnet bitcoin-testnet-rpc ceph ceph-mon cfengine cockpit condor-collector ctdb dhcp dhcpv6 dhcpv6-client distcc dns docker-registry docker-swarm dropbox-lansync elasticsearch etcd-client etcd-server finger freeipa-ldap freeipa-ldaps freeipa-replication freeipa-trust ftp ganglia-client ganglia-master git gre high-availability http https imap imaps ipp ipp-client ipsec irc ircs iscsi-target isns jenkins kadmin kerberos kibana klogin kpasswd kprop kshell ldap ldaps libvirt libvirt-tls lightning-network llmnr managesieve matrix mdns minidlna mongodb mosh mountd mqtt mqtt-tls ms-wbt mssql murmur mysql nfs nfs3 nmea-0183 nrpe ntp nut openvpn ovirt-imageio ovirt-storageconsole ovirt-vmconsole plex pmcd pmproxy pmwebapi pmwebapis pop3 pop3s postgresql privoxy proxy-dhcp ptp pulseaudio puppetmaster quassel radius redis rpc-bind rsh rsyncd rtsp salt-master samba samba-client samba-dc sane sip sips slp smtp smtp-submission smtps snmp snmptrap spideroak-lansync squid ssh steam-streaming svdrp svn syncthing syncthing-gui synergy syslog syslog-tls telnet tftp tftp-client tinc tor-socks transmission-client upnp-client vdsm vnc-server wbem-http wbem-https wsman wsmans xdmcp xmpp-bosh xmpp-client xmpp-local xmpp-server zabbix-agent zabbix-server

Has my fresh DietPi install already been rooted? Why would they include a bitcoin client if the goal of the system is to be as minimal as possible?

From my very basic understanding of security... I imagine turning off as many services as possible is seemingly the best thing.

Improve this question
3
  • 1
    "my very basic understanding of security" -> Dangerous when combined with naive zeal. A general premise is that the people who put the system together and wrote the software probably have a significantly better understanding of security and you are better off trusting their decisions. Of course, you are really talking about minimising the number of things you need to trust, but this is not clear cut: It is entirely possible that with too much fiddling you won't need malware to disrupt the system because you did it yourself accidentally. Whoops! Let that risk balance the urge.
    – goldilocks ♦
    Commented Jun 2, 2020 at 15:23
  • WRT what those services are, most (or all) of them will have some documentation online. For example, a quick search for "linux amanda" turns up a wikipedia article. The articles there about specific pieces of software almost always have a link to a homepage in the top right sidebar. Another place to start is /usr/share/doc/_____/README; e.g., replace ____ with audit and you will get some further clues about that (and another: audit is one of those things you should just leave as is).
    – goldilocks ♦
    Commented Jun 2, 2020 at 15:30
  • I definitely need to closely follow some guidelines for how to harden the security... not going to trust my own abilities at this point :) So there's basically not much to be done? I need to lock this system down to the bare minimum and minimize it as a potential attack vector.
    – Robotica
    Commented Jun 3, 2020 at 8:30

1 Answer 1

Reset to default
2

Why do you think it has the software installed? Just because the firewall is configured to recognise it for port requirements it does not mean the software is present. A list is available at this page of pre-loaded software - about 1/3 down the page.

I would start with running dietpi-launcher or dietpi-software to see what is installed.

To find out what ports are currently being used, run

sudo lsof -i -P -n

Note: sudo may not be needed if you are logged on a root (default in dietpi) and you should get a list shorter than:

COMMAND    PID  USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
avahi-dae  236 avahi   12u  IPv4  10104      0t0  UDP *:5353 
avahi-dae  236 avahi   13u  IPv4  10106      0t0  UDP *:33110 
cnid_meta  334  root    3u  IPv4  10992      0t0  TCP 127.0.0.1:4700 (LISTEN)
afpd       348  root    3u  IPv4  11008      0t0  TCP *:548 (LISTEN)
dhcpcd     474  root   10u  IPv4  11586      0t0  UDP *:68 
sshd       491  root    3u  IPv4  12110      0t0  TCP *:22 (LISTEN)
sshd      2602  root    3u  IPv4  79200      0t0  TCP 192.168.1.60:22->192.168.1.100:50482 (ESTABLISHED)
sshd      2618    pi    3u  IPv4  79200      0t0  TCP 192.168.1.60:22->192.168.1.100:50482 (ESTABLISHED)

Note I'm running NETATALK on the above box for file sharing and ssh'd in so it's longer than normal.

If you are that concerned and unsure where to look, start with Raspberry Pi OS Lite (what a mouthful) and add Apache.

Improve this answer
5
  • Have zero experience with NETATALK :) I would highly appreciate guidelines as to what could possibly be done in order to further secure the basic install of Dietpi... perhaps I should visit their forums. Also, maybe my question is really a matter of what would be a good basic nftables config.
    – Robotica
    Commented Jun 3, 2020 at 8:34
  • NETATALK is great if you are using a Mac - not good for iPads or PCs. The Dietpi forum is good - not as busy as the RPF/RPT one or here. For security, start with the bare minimum open and even lock that down as much as possible. So for internal web servers I only allow local machines and port 80 open and if I want to view them from out of the house it's a VPN back in. SSH is locked down to key only and where the Pi user exists it's a complex password secured by biometrics (Apple Keychain security). Some good white hat security courses are free and Cisco have had a free one recently.
    – user115418
    Commented Jun 3, 2020 at 12:57
  • That sounds like a good way to go. Do you perhaps have a basic example of how to shut down port ranges with nftables? Would you recommend I find another tool?
    – Robotica
    Commented Jun 3, 2020 at 13:09
  • I like ufw for command line and gufw for a gui version. Normally expect to lock yourself out of one Pi when learning and doing this remotely - a keyboard / monitor directly connected helps :-) I also have a job that runs every 10-15 mins that disables all firewall settings while testing - this gives me enough time to kick myself and get a cup of tea if I do lock myself out from afar.
    – user115418
    Commented Jun 3, 2020 at 13:17
  • Sounds like fun :)
    – Robotica
    Commented Jun 8, 2020 at 12:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.