What is the best way to permanently disable all types of networking in Raspbian?

Question

I wish to completely disable all networking capabilities on Raspbian running on a raspberry pi 2. What is the best way to accomplish this?

It is of utmost importance that no user of this device accidentally plugs in an ethernet cable or wifi-dongle and gets an internet connection.

The more non-reversible the process is, the better.

Answer 1

This is really futile since if you don’t secure the hardware, all someone with access to the device would have to do to defeat it would be to insert an SD card and boot from it.

But some things you could do include

• blacklisting drivers. See here for one example.
• build a new kernel without any network drivers.
• block the loading of kernel modules so no one could load a network driver
• set up iptables and block all network connections

Note all of these can be done in tandem to add layers of protection that is, again, futile if physical security is compromised. Building a kernel without networking isn't an easy solution since things like X windows use networking so you would have quite a task to remove all the drivers you didn't want while keeping those you do.

If you share more about why you feel you need to do this people may be able to come up with better solutions. For example changing your router to a MAC whitelist only could help prevent new network interfaces from gaining internet access.

Answer 2

It depends on the level of security you want to realize. A simple but viable solution is to deinstall all network systems. This will prevent newbies to do networking by accident/neglect and it will prevent those with malicious intent to destroy/spy the RasPi from a remote side. If such people have physical access to the RasPi there is no way to prevent them to do bad things.

On Raspbian are three network systems available: default used dhcpcd, optional usable old style Debian networking managed with the file /etc/network/interfaces and ifupdown and the disabled systemd-networkd. You can deinstall dhcpcd and ifupdown but not systemd-networkd because it is integral part of systemd, a core software component. But a user without networking skills shouldn't be able to simply enable and configure systemd-networkd.

To deinstall network components as far as possible you can just do:

rpi ~$ sudo apt --autoremove purge openresolv
rpi ~$ sudo apt --autoremove purge ifupdown
rpi ~$ sudo apt --autoremove purge dhcpcd5
rpi ~$ sudo apt --autoremove purge isc-dhcp-client isc-dhcp-common

Now there is no way to connect to the RasPi by network and it is also not possible to reinstall these components from the remote repository. The only way to get it back is to configure systemd-networkd and reinstall the components.