Hardening your Pinebook Pro

[Arwen]

There are several things I tend to do, making client systems listen on fewer external services. And not run un-needed local services.

What do you do?

Here is my list, (a work in progress);

SSHD - Disable Root login
File - /etc/ssh/sshd_config
PermitRootLogin no
Service - systemctl restart sshd

NTPD - Don't allow others to use me for time source
File - /etc/ntp.conf
restrict 127.0.0.1 nomodify nopeer noquery limited kod
restrict [::1]
interface ignore wildcard
interface listen 127.0.0.1
interface listen ::1
Service - systemctl restart ntpd

Chromium browser
Launcher change: --password-store=basic

SMBD - Disable Samba services
systemctl stop smbd
systemctl disable smbd
systemctl stop nmbd
systemctl disable nmbd

Avahi service
systemctl stop avahi-daemon.service
systemctl stop avahi.daemon. socket
systemctl stop dbus-org.freedesktop.Avahi.service
systemctl disable avahi-daemon.service
systemctl disable avahi.daemon. socket
systemctl disable dbus-org.freedesktop.Avahi.service