0

I wish to completely disable all networking capabilities on Raspbian running on a raspberry pi 2. What is the best way to accomplish this?

It is of utmost importance that no user of this device accidentally plugs in an ethernet cable or wifi-dongle and gets an internet connection.

The more non-reversible the process is, the better.

Improve this question
9
  • 1
    If someone has access to the device, she can hack it. – Janka Jan 23 '19 at 17:06
  • Of course, but I want to make it as difficult as possible. Both for those with malicious intent, as well as newbies who might do it by accident/neglect. – user3207230 Jan 23 '19 at 17:11
  • Blacklist some drivers. – goldilocks♦ Jan 23 '19 at 17:15
  • Non-reversible? Ok, for starters you could de-solder the Ethernet port. Then destroy or remove the Wi-Fi chip (but in so doing, be prepared to lose bluetooth as well), not sure if this is possible without killing the Pi itself. This should be sufficient to prevent any accidental internet connection, but this still leaves the possibility that an Ethernet dongle could be connected to the USB port. – Glen Yates Jan 23 '19 at 17:22
  • 2
    1. Replace the 3B/3B+ with a 2B. There's no wifi on a 2B. 2. Crimp a RJ45 plug with no cable (so you can plug it into the ethernet socket). Hot glue that in place. 3. Hot glue the SDCard into the socket. Hot glue all of the USB sockets so you can't insert any device (or glue essential devices into the USB socket). 4. Mount the RPi in a locked cage so that nobody can touch the hardware. – Dougie Jan 23 '19 at 17:48
1

This is really futile since if you don’t secure the hardware, all someone with access to the device would have to do to defeat it would be to insert an SD card and boot from it.

But some things you could do include

  • blacklisting drivers. See here for one example.
  • build a new kernel without any network drivers.
  • block the loading of kernel modules so no one could load a network driver
  • set up iptables and block all network connections

Note all of these can be done in tandem to add layers of protection that is, again, futile if physical security is compromised. Building a kernel without networking isn't an easy solution since things like X windows use networking so you would have quite a task to remove all the drivers you didn't want while keeping those you do.

If you share more about why you feel you need to do this people may be able to come up with better solutions. For example changing your router to a MAC whitelist only could help prevent new network interfaces from gaining internet access.

Improve this answer
0

It depends on the level of security you want to realize. A simple but viable solution is to deinstall all network systems. This will prevent newbies to do networking by accident/neglect and it will prevent those with malicious intent to destroy/spy the RasPi from a remote side. If such people have physical access to the RasPi there is no way to prevent them to do bad things.

On Raspbian are three network systems available: default used dhcpcd, optional usable old style Debian networking managed with the file /etc/network/interfaces and ifupdown and the disabled systemd-networkd. You can deinstall dhcpcd and ifupdown but not systemd-networkd because it is integral part of systemd, a core software component. But a user without networking skills shouldn't be able to simply enable and configure systemd-networkd.

To deinstall network components as far as possible you can just do:

rpi ~$ sudo apt --autoremove purge openresolv
rpi ~$ sudo apt --autoremove purge ifupdown
rpi ~$ sudo apt --autoremove purge dhcpcd5
rpi ~$ sudo apt --autoremove purge isc-dhcp-client isc-dhcp-common

Now there is no way to connect to the RasPi by network and it is also not possible to reinstall these components from the remote repository. The only way to get it back is to configure systemd-networkd and reinstall the components.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.