A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.
61

According to ARM themselves, the processor cores used in all models before the Pi 4 are not vulnerable. The majority of Arm processors are not impacted by any variation of this side-channel speculation mechanism. A definitive list of the small subset of Arm-designed processors that are susceptible can be found below. [see link for the table] The ...


54

Securing a computer is not a simple process, entire books are written on the topic. The Pi's size does not reduce the security threat or attack surface presented to a possible attacker. As a result, I will describe the steps involved and provide links to more detailed instructions and tutorials. Since you have not mentioned what distro you are using I will ...


41

There are many ways to address vulnerabilities, however the first thing you should know is that Linux isn't as susceptible to intrusion as other Operating Systems. This is mainly due to lack of malware that targets *NIX. Nevertheless, you want to be aware of the ways in which your system can be accessed. Passwords Firstly you should change the default ...


31

I've been using my model B as a router with traffic shaping, using just the one Ethernet port it comes with. Here's a quick-and-dirty on how: Enable IPv4 Forwarding, so your Pi acts as a router by forwarding any traffic it receives Configure your Pi with static network configuration so it will not be influenced by DHCP changes suggested below. Here are the ...


26

The core affected package is libssl1.0.0, which if you can, just replace with the patched version, restart everything. You can try to download a binary, and manually install an arm-hf, using dpkg with the version 1.0.1e-2+deb7u5 for wheezy. You can also use the jessie repository, just for this single one time update, which should get you version 1.0.1g-1. ...


23

Things I've noticed so far about the stock Debian Squeeze image: /etc/shadow contains a bunch of password hashes for accounts that aren't the pi account (buildbot, etc). Change the password on the pi account, naturally, if you haven't already (or make a new user account for yourself and delete the pi account) but also edit the other entries and replace the ...


22

Debian The official Debian image ships with at least 2 users, root and pi. You will only be able to login to the pi account. How do I change pi's password? At the very least, you should change the password for the pi account, as anybody with a RPi will be able to log onto yours. To do this, run passwd from the command line and follow the prompts. How do ...


22

The Pi (all versions) is not vulnerable. Spectre and Meltdown both require out-of-order execution. The Cortex-A7 used in the early Pi 2 and the Cortex A53 used in the later Pi 2 and the Pi 3 is a strictly in-order architecture. The ARM11 used in the Pi 1 is partially out-of-order, but not in a way that permits Spectre or Meltdown to work. ARM confirms ...


18

Arch A fresh Arch install ships with only the root user available. Thus you should definitely be creating a new user, as spending too much time as root is dangerous. In addition, you should also change the root password, as leaving as default is a major security risk. Changing the root password The password can be changed when logged in as root by running ...


17

Since consumer SD cards use top-secret Flash Translation Layers and actually have more capacity than advertised to remap bad blocks or for general wear leveling this is impossible via shred. The writes to a file might not end up at the same place where it currently exists on the disk at all. You have four choices : 1) Physical destruction. 2) Shred single ...


15

Yes, your Pis are vulnerable until the patched versions of the Debian packages are available for Raspbian. Edit: The patched versions are now available for Raspbian.


13

It is tricky to rename an account while you are logged in to it, and easy to accidentally lock yourself out of your Pi, so first enable the root account with $ sudo passwd root Use a secure password, even if you intend to lock the root account again later. Then log out and log back in as root. The rest supposes a desired username of "myuname" - replace ...


12

You will want to add a second network connection to you Pi (either a usb to ethernet or WiFi dongle. Then you will want to install iptables and configure it as a home router. Having said that you will likely have performance issues going this route. In the end you may be better off picking up an older router that supports dd-wrt that allows you to ...


11

You could encrypt the whole disk, pv, or volume using LUKS/dm-crypt if your distribution supports it. It's also possible to encrypt files or directories on the disk while leaving the filesystem mountable (but scrambled). Either way, you'll run into an issue: Before using the clear data, someone has to input the key. If the key is stored on the card, nothing ...


11

Having looked at the RPi, it seems like a fairly secure device out the box, as long as you do a couple of things. The default user/pass needs changed. At the very least, change the password. For better security again, change the username as well. (Add a new user, then disable PI. Check that ROOT is also disabled from SSH login, though I think it is by ...


10

Having a little network background, the first thing that comes to mind is use it as a Snort box, and then you don't have to worry about only having one interface. You would setup your switch/router to forward all traffic to the Pi, but also pass it onto the end device. This is known as a switchport monitor, but your device may not support it. You may need ...


10

I'd like to offer my different take on this. About Meltdown, it's a very specific vulnerability in some processors, so if ARM says the CPU in Raspberry Pi is not vulnerable, then it can probably be trusted. However, Spectre is a more general vulnerability. So far, only two variants have been demonstrated but I'm pretty sure there are more variants. The ...


9

Linux is a multi-user environment by default. Each user has his own folder in /home/TheUserName Users are highly restricted outside that folder. They only have read access to most things. By default, the Raspberry Pi comes with a single user called pi. This user has a home directory called /home/pi/. The catch: By default the pi user has the ability to ...


9

This is a trace of a default script (introduced in the November 2016 Raspbian release) which checks if you changed the password for the user pi. The script is stored in /etc/profile.d/sshpasswd.sh and displays a warning if the SSH deamon was turned on, but the password for the pi user had not been changed from the default one (raspberry). It is called on ...


9

Auto-login is simply a convenience feature. By default, on the local console or UI, it provides the ability to not have to enter your user password before continuing loading the user's environment. It's insecure only if anyone else has direct, physical access to your Pi. Over SSH remotely, the user's password will still be required (so you definitely should ...


8

I would use TrueCrypt. Some of it's main features (from the site) include: Creates a virtual encrypted disk within a file and mounts it as a real disk. Encrypts an entire partition or storage device such as USB flash drive or hard drive. Encryption is automatic, real-time (on-the-fly) and transparent. Parallelization and pipelining allow data to ...


8

CA certificates are located in /etc/ssl/certs as well as /usr/share/ca-certificates/ and in some cases /usr/local/share/certificates. In general CA certs should not be manually added to the local trust store. There are reasons why certain CAs are not included. Without further research, it's unclear why this particular CA root cert was not included in ...


7

I have used the Raspberry Pi for routing, and it worked well. As you say, you need at least one more network interface, as the Raspberry Pi has only one Ethernet port. You can add another interface connected to the USB port. I have used a GSM modem and a Wi-Fi stick. Things to note: Use a powered USB hub. Wi-Fi and GSM devices demand more power than what ...


7

how about this for a start sudo apt-get install ecryptfs-utils sudo apt-get install lsof sudo ecryptfs-migrate-home -u pi There will be a bit more to it but thats the main part - it will only cover your home folder. If you want to do more then its something like: https://www.howtoforge.com/how-to-encrypt-directories-partitions-with-ecryptfs-on-debian-...


7

Extra trick on raspbian with usermod usermod command won't run if there are any processes of the to-be-changed user running on the machine when the command is run. If your on console of the pi there is a way to get around this without having to make another user (or set a pw on root): Assuming nothing else is running with your username other then the ...


7

There's nothing I'm aware of that'll prevent you from physically removing or disabling the WiFi chip by desoldering it and/or cutting its traces. Alternatively, you just stick the whole thing in a tinfoil bag or a lead box. Given the relatively huge number of questions asked here relating to problems persuading a Raspberry Pi to connect to any kind of ...


7

You need to use raspi-config to enable SSH. Previously the default value was "enabled" but in November 2016 this has been changed due to the security issues and the default value is now "disabled". For more info see here. Alternative method is to place a file ssh in /boot partition of the SD card. Content of the file is not important.


7

You can disable the HDMI output on your Pi by running: /usr/bin/tvservice -o (the option is documented in the code here) The USB ports can apparently be disabled by running: echo 0x0 > /sys/devices/platform/bcm2708_usb/buspower However, since the USB and Ethernet share a controller, turning off the USB also disables the Ethernet... which isn't great, ...


6

To prevent bruteforce attacks, you can install and configure fail2ban. It will parse log files (such as /var/log/auth.log) and try to detect if several login attempts have failed. Then, it will automatically ban the source IP addresses with iptables. There are a bunch of howtos around the Internet.


Only top voted, non community-wiki answers of a minimum length are eligible