I want to boot the RPi 3 and run the OS from a write protected USB Drive to protect the operating system, then start a VPN client so that mobile internet access is reasonably secure. It this possible?

  • Does the drive have to be USB? In most cases it's just as easy to "write-protect" an SD card and SD cards may support additional write protection modes that most USB drives do not support. – cjs Apr 18 '17 at 2:44
  • You can do that, but you will have to read and write mount it every time you want to update. You wouldn't want your VPN setup to be outdated and possibly have big security holes. – Dr_Bunsen Apr 18 '17 at 8:18
  • I prefer USB thumb drives with write protect switches as they are more convenient to carry, such as on a keychain. My objective is a small pocket-sized unit that will provide more security when travelling than a laptop or tablet or cellphone. If the operating system is protected from hacks during use, it would not be too much trouble to reformat the second scratch drive USB stick after use and to flip the write protect switch on the boot USB stick when updating from a secure site is necessary. Thanks for your help. – Techman Apr 19 '17 at 18:49

It's possible, but it may be difficult, depending on the operating system. Note also that, unless you're using a USB drive that features its own (hardware) write protection, merely configuring the OS not to mount writable filesystems does not mean that an attacker who gains enough access can't re-mount the filesystems as writable. You should also note that the write protect tab on SD cards is advisory only.

On the Pi the most commonly used OS for VPNs and many other networking tasks is Raspbian, which is a variant of Debian Linux. A very large number of components in most Linux systems rely on being able to write to the drive; the two chief uses are to save transient data (such as DHCP leases) and to write logs. Without the former some fairly important software (such as the default DHCP client!) will simply not work; for the latter you may be able to hack the journald configuration to live with no logging to disk but it's probably not trivial, and not everything goes through journald.

You'd also, of course, need to be able to restart the system in read-write mode any time you needed to reconfigure anything (such as changing VPN passwords).

If you really want to go with an entirely read-only OS, something other than Linux is probably what you want. (At least, something other than "regular" Linux. One of the router/firewall distributions may do what you need.) If you're going to use Linux, using a fairly strict SELinux profile is probably the most practical way to substantially decrease the risk of a system being compromised by attacks on its servers (as opposed to its users).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.