61 votes

Is the Raspberry Pi vulnerable to the Spectre or Meltdown exploit?

According to ARM themselves, the processor cores used in all models before the Pi 4 are not vulnerable. The majority of Arm processors are not impacted by any variation of this side-channel ...
Aurora0001's user avatar
  • 6,278
22 votes

Is the Raspberry Pi vulnerable to the Spectre or Meltdown exploit?

The Pi (all versions) is not vulnerable. Spectre and Meltdown both require out-of-order execution. The Cortex-A7 used in the early Pi 2 and the Cortex A53 used in the later Pi 2 and the Pi 3 is a ...
Mark's user avatar
  • 376
19 votes
Accepted

Entrusted Certificates installation

CA certificates are located in /etc/ssl/certs as well as /usr/share/ca-certificates/ and in some cases /usr/local/share/certificates. In general CA certs should not be manually added to the local ...
RubberStamp's user avatar
  • 1,389
17 votes
Accepted

Self destruct: self erase all data on SD card using shred, dd or some other method

Since consumer SD cards use top-secret Flash Translation Layers and actually have more capacity than advertised to remap bad blocks or for general wear leveling this is impossible via shred. The ...
flakeshake's user avatar
  • 6,215
15 votes

Is the Raspberry Pi vulnerable to the KRACKs on WPA2 networks?

Yes, your Pis are vulnerable until the patched versions of the Debian packages are available for Raspbian. Edit: The patched versions are now available for Raspbian.
speakr's user avatar
  • 259
10 votes
Accepted

Strange grep /etc/shadow command appearing in my logwatch

This is a trace of a default script (introduced in the November 2016 Raspbian release) which checks if you changed the password for the user pi. The script is stored in /etc/profile.d/sshpasswd.sh ...
techraf's user avatar
  • 4,319
10 votes

Is the Raspberry Pi vulnerable to the Spectre or Meltdown exploit?

I'd like to offer my different take on this. About Meltdown, it's a very specific vulnerability in some processors, so if ARM says the CPU in Raspberry Pi is not vulnerable, then it can probably be ...
juhist's user avatar
  • 201
10 votes

Does Raspberry Pi 4 processor support AES-NI instructions?

The Raspberry Pi 4 does not have cryptographic extensions, to be more precise it has, but to be enabled would require HW changes alongside paying a license to Broadcom/ARM. Here's the link for a ...
Carlos Lint's user avatar
9 votes
Accepted

What is the purpose of auto-login? Is it safe/secure?

Auto-login is simply a convenience feature. By default, on the local console or UI, it provides the ability to not have to enter your user password before continuing loading the user's environment. ...
stevieb's user avatar
  • 1,476
8 votes
Accepted

Disable ALL video outputs and USB Ports. Only remote access

You can disable the HDMI output on your Pi by running: /usr/bin/tvservice -o (the option is documented in the code here) The USB ports can apparently be disabled by running: echo 0x0 > /sys/...
Aurora0001's user avatar
  • 6,278
7 votes

Air-gapping the Raspberry Pi 3

There's nothing I'm aware of that'll prevent you from physically removing or disabling the WiFi chip by desoldering it and/or cutting its traces. Alternatively, you just stick the whole thing in a ...
goobering's user avatar
  • 10.7k
7 votes

No SSH (Connection refused) using raspbian with pixel

You need to use raspi-config to enable SSH. Previously the default value was "enabled" but in November 2016 this has been changed due to the security issues and the default value is now "disabled". ...
lewiatan's user avatar
  • 713
7 votes
Accepted

Adding Debian Security Repository GPG key

Get the missing public keys from the Ubuntu keyserver and try if it helps: rpi ~$ sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys AA8E81B4331F7F50 112695A0E562B32A Executing: /tmp/apt-...
Ingo's user avatar
  • 41.9k
6 votes

Is the Raspberry Pi safe

How much do you trust this company? You don't specify how this device will be connected to your computer, but I assume that it will be able to see every site you visit - this would include your bank, ...
Steve Robillard's user avatar
6 votes
Accepted

Official "securing your pi" guide recommends blocking port 30 from 192.168.2.1 - why?

In the preface of Securing your Raspberry Pi the author says: This documentation will describe some ways of improving the security of your Raspberry Pi. This is followed by a conglomeration of ...
Fabian's user avatar
  • 1,260
6 votes

Is older Raspberry Pi safe? When is the end of software support for them?

The same version of Raspberry Pi OS works on all Pi models. https://www.raspberrypi.org/downloads/
joan's user avatar
  • 70.5k
5 votes
Accepted

How to fix glibc vulnerability CVE-2015-7547

According to the Debian Security Tracker entry for this vulnerability, updates for glibc/eglibc/libc6 will fix this issue: wheezy: 2.13-38+deb7u10 jessie: 2.19-18+deb8u3 These are available for ...
kba's user avatar
  • 312
5 votes
Accepted

always-on security camera, uploading to cloud, looping video recording/saving

This is fairly easy to accomplish with the picamera API, specifically the record_sequence method. I won't tackle the cloud upload bit as that'll bloat this example horribly, but it's pretty easy to ...
Dave Jones's user avatar
  • 3,978
5 votes

Disable ALL video outputs and USB Ports. Only remote access

Other than the "locked case" solution, you could remove the USB drivers for input devices. That would allow the USB-based networking to continue working while stopping keyboards and mice working. ...
pjc50's user avatar
  • 225
5 votes

Security of using Raspberry Pi for online banking

I don't see any reason why a properly secured Pi should be any less safe than a Windows machine; probably the Pi would be marginally safer. Recent versions of Raspbian (e.g. Stretch) come with SSH ...
Aurora0001's user avatar
  • 6,278
5 votes

Any parental control tools for the Raspberry Pi 4?

limiting the time a kid is logged into the device Check out  timeoutd, timekpr-next and similar software packages. access to specific URLs (e.g. classroom etc) Disable DNS and whitelist all hosts ...
Dmitry Grigoryev's user avatar
4 votes

How best to extend the PI with hardware decryption/encryption, TPM/HSM?

Actually Infineon Technologies (my employer) does even have a TPM daughterboard for the RPI2/3 and an application note how to set some stuff up. See: https://www.infineon.com/cms/de/product/security-...
Peter Huewe's user avatar
4 votes
Accepted

Is it still safe to use pidora?

Pidora stopped being updated at least a year ago; I could go check my logs to be sure, but it was well before F20 reached EOL. I also had an x86-64 F20 system up for the duration and it was receiving ...
goldilocks's user avatar
  • 58.5k
4 votes
Accepted

SELinux on Raspberry Pi 3 running CentOS 7

SELinux requires kernel support, and the default Raspberry Pi kernel does not include it. You can check the configuration this way: sudo modprobe configs sudo gunzip -c /proc/config.gz | grep SELINUX ...
goldilocks's user avatar
  • 58.5k
4 votes
Accepted

Until when does Raspbian Wheezy receive *security* updates?

Wheezy in general has been handed over to the Debian LTS team as of 25 April of this year (2016). The official answer for LTS support is May 31, 2018 (https://www.debian.org/News/2016/20160425.en.html)...
Brandon Denning's user avatar
4 votes
Accepted

Unable to setup RKHunter ("Invalid SCRIPTWHITELIST configuration option")

Since nobody stepped up I continued searching and found a few things that I think can help answer this question for documentation's sake and future readers. Use at your own risk. If anyone has some ...
MFJC's user avatar
  • 235
4 votes

Is the Raspberry Pi vulnerable to the KRACKs on WPA2 networks?

No, (but yes it was) a fully updated Raspberry Pi (Zero) with Stretch is no longer vulnerable. Updates were made available this early morning. Just run: sudo apt update && sudo apt upgrade ...
Janghou's user avatar
  • 1,436
4 votes

Entrusted Certificates installation

In Raspbian GNU/Linux 9.4 (stretch) your local CA certificates should be placed in /usr/local/share/ca-certificates to be added to /etc/ssl/certs/ca-certificates.crt. These should have a .crt ...
hfmanson's user avatar
  • 141
4 votes

Motion security

It's simple. There is some TLS feature for the web interface and also for the stream port. Generate your certificate files: apt-get install openssl openssl genrsa -out /etc/motion/motion.key 4096 ...
M. Rostami's user avatar
  • 4,285

Only top scored, non community-wiki answers of a minimum length are eligible