Questions on securing a Pi 3

[gets.chomp]

Hi everyone,

So basically I would like to use my Pi as a Smart TV on steroids to browse the net.

Here is the way I was thinking of having my security in place on my Pi (model 3 b) as well as some questions to finish everything. If you have any suggestions go ahead. The idea is to stay safe against scripts in ads executing malicious code, viruses (if any on Linux) and prevent getting hacked and used as a botnet. I'm not very savvy so I'm trying to stay simple but efficient.

• - I was thinking of creating and using a new standard user and have it's home folder deleted at every boot (kind of like the Guest account on Mac). What is that and a firewall enough as security to just browse the internet and protect against malicious scripts in ads for example ? Thanks !
  
  I was thinking of following this set up, what do you think, are the commands all legit ? I checked and to me it seems yes:
  https://raspberrypi.stackexchange.com/q ... 4712#14712
  https://raspberrypi.stackexchange.com/a/58778/62747
  
  Question: How do I add the new users to Audio and Video groups ? Do I have to add new users there ? What groups are needed to browse the net as this new user ?

• - Do I have to set a password for root ? Based on research I have found it's not a good idea.
  - How can I require password for sudo ?
  - How can I check current status or disable remote login to the root account ?
  - How can I deactivate FTP and check its status ?
  - Are elements like Chromium adding I chose and UFW settings automatically applied to all current AND FUTURE users ?
  - Can the recovery partition be hacked ?

- In addition I use the firewall UFW with deny all incoming and allow all outgoing as defaults with deny in and out for other IPs in my home network to try to "lock" (is it enough to lock the Pi from the rest of the network?).

That's all my "easy but efficient" strategy, should it be enough according to you ? If you have any suggestions go ahead, thanks !

[gets.chomp]

Anyone please ?

[kusti8]

Anyone please ?

It's been four hours. This forum is run by volunteers. Wait patiently.

To answer your question, all you need is an adblocker and some common sense. Since it's a raspberry pi chances are that any malware is not going to run since it's not compiled for ARM. It's just like a desktop. Don't go to shady websites and you're fine.

[gets.chomp]

Never meant to push anyone, just wanted to refresh a bit my post.
Thanks for your input.

[jamesh]

There's a security docs page under development - take a look at that.

https://github.com/raspberrypi/document ... ecurity.md

[gets.chomp]

Thanks it's pretty interesting !
If I don't use SSH and it's deactivated, no need for Fail2Ban right ? Fail2Ban only focuses on SSH right ?
How can I ensure FTP is also disabled, I can't check it's status with raspi-config.

[jamesh]

I think Fail2ban is still useful as it automatically updates the firewall setting from log information, even if ssh is disabled. However, I am not a security expert!

[rpdom]

FTP will always be disabled until you install an FTP server program.

[gets.chomp]

Ah ok thanks for that clarification !

Also if I install Fail2Ban as Pi but later browse the net using a normal basic account I created. Will the Fail2Ban settings also watch my computer when I'll be logged in as the normal user ? In essence, will the Fail2Ban settings apply to all users, present and future ? Thanks everyone !