0

I'm not sure where to post this so I'll start here.

I am completely new to the Raspberry Pi and Raspbian Linux (any Linux for that matter). I want to create an RPi that will be completely disconnected from a network and without the possibility of someone accidentally turning on networking. I would like to completely remove the TCP/IP stack as well as any other networking stack and remove the wireless connectivity. I would also like to make it so that only certain devices can be plugged into the USB ports and be recognized. I'm working on an RPi 3B

Any help or guidance would be greatly appreciated.

Improve this question
2

Removing the whole TCP/IP stack is unadviseable because it is also used internally, for sockets using the loopback network. Many programs rely on that.

You could remove the hardware drivers for ethernet and wireless, rendering them unuseable. However, this will only help against accidentally turning on the network. Root can always reboot into another kernel, which have all the features he wants.

Same for USB devices. You could remove the drivers for all unwanted devices, or just remove the udev rules or services which are started when certain classes of devices are plugged. This is all fairly easy to do but a bit tedious as it's so many tiny bits of features to remove.

Improve this answer
2
  • How could I make it so that even root couldn't boot into a different kernel? I want to create a machine that will be completely stand alone and unable to be networked in any way. I'm trying to create a version of Linux that is utterly unhackable unless you physically connect to it. – Wayne E. Pfeffer Oct 29 '16 at 0:34
  • Erm, when you have no network, the only way root can work on the machine is when physically connected. However, you do this in the wrong direction. It's possible to create a "safer" device but one has to define very clearly which connectivity to outside is needed for the application, then disable (better: start from scratch and not even include/enable) anything unneeded, then safeguard the remaining connectivity by doing a code review. But first step is defining what is needed for the application. – Janka Oct 29 '16 at 8:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.