I don't know if this is possible.
I'm hosting a web farm on raspberry pi (for fun).
And one of them is at friend's house. I can access the pi remotely using VNC. How can i prevent my friend from accessing the PI like plugging it to a screen?
Raspberry Pi Stack Exchange is a question and answer site for users and developers of hardware and software for Raspberry Pi. It only takes a minute to sign up.Sign up to join this community
You can disable the HDMI output on your Pi by running:
(the option is documented in the code here)
The USB ports can apparently be disabled by running:
echo 0x0 > /sys/devices/platform/bcm2708_usb/buspower
However, since the USB and Ethernet share a controller, turning off the USB also disables the Ethernet... which isn't great, if you're hoping to connect via Ethernet to your Pi!
Note also that if the Pi is rebooted, these settings will not persist, so the attacker would briefly be able to access USB and video output.
Alternatively, you could, if you're willing to physically modify the Pi, just block the ports with a filler material. This must of course be irreversible, so the Pi will be irreparably damaged, but may at least place a roadblock in the way of an attacker.
Ultimately, a determined attacker with physical access could work around any of these constraints (simply by taking out the SD card and editing it to disable all of these protections). Depending on how important the data is, you need to decide whether you can trust your friend not to tamper with the device (else host it yourself).
Other than the "locked case" solution, you could remove the USB drivers for input devices. That would allow the USB-based networking to continue working while stopping keyboards and mice working. However, none of this prevents him from removing the SD card and accessing the files directly - hence the need to lock it in a box.
(I believe this is input.o, hid.o and mousedev.o modules, but I've not tried it.)
Another solution (you have asked in a comment for a "'production' solution") could be to restrict physical access by encapsulating the Raspberry Pi into a lockable case (container like a server rack or IT cabinet). This way you do not need to partial damage the device with glue or something like that.
There are small cabinets available with a glass door. This could be really usefull if you need the status of the LEDs: in case you need this information simply ask your friend to look for the LEDs and report back.
Just a few different examples, not a recommendation:
Or you could build your own case like you need it. Options are endless.