It depends on the level of security you want to realize. A simple but viable solution is to deinstall all network systems. This will prevent newbies to do networking by accident/neglect and it will prevent those with malicious intent to destroy/spy the RasPi from a remote side. If such people have physical access to the RasPi there is no way to prevent them to do bad things.
On Raspbian are three network systems available: default used dhcpcd
, optional usable old style Debian networking
managed with the file /etc/network/interfaces
and ifupdown
and the disabled systemd-networkd
. You can deinstall dhcpcd
and ifupdown
but not systemd-networkd
because it is integral part of systemd
, a core software component. But a user without networking skills shouldn't be able to simply enable and configure systemd-networkd
.
To deinstall network components as far as possible you can just do:
rpi ~$ sudo apt --autoremove purge openresolv
rpi ~$ sudo apt --autoremove purge ifupdown
rpi ~$ sudo apt --autoremove purge dhcpcd5
rpi ~$ sudo apt --autoremove purge isc-dhcp-client isc-dhcp-common
Now there is no way to connect to the RasPi by network and it is also not possible to reinstall these components from the remote repository. The only way to get it back is to configure systemd-networkd
and reinstall the components.