Protect your Raspberry PI SD card, use Read-Only filesystem

[dgatwood]

You should really add some commentary about the tmpfs lines in /etc/fstab before the code listing. When I got to that step, I read that we were ready to set the volume to read-only, and thought, "I know how to do that," and stopped reading at that point, resulting in an unbootable system. I'd imagine many other folks with sysadmin experience will do the same. Actually, you should probably add the tmpfs lines first before you start making changes that depend on them, then make the changes, then change fstab a second time to make it read-only. Also, for Jessie, the systemd changes are unnecessary, because /run is already a tmpfs volume. And it might be worth redirecting things from /var/run to /run just for simplicity (on Jessie).

[Bruno Duarte]

How to fix this ?

pi@raspberrypi(ro):~$ reboot
Failed to execute operation: The name org.freedesktop.PolicyKit1 was not provided by any .service files
Must be root.

[mjeanne]

you need to be root..
use 'sudo'

[mocart2]

Hello! Can anybody help me with user crontab file? I have problem: i installed raspbian in Read-only mode, i have some scripts, (cron jobs) that works every 5 minutes, 10 etc. I set it by crontab -e command, but after reboot, system is clean it, i think, because i moved /var/spool dir to tmpfs (like howto), and user cronjob file stored at /var/spool/cron/crontabs dir. How i can fix it for not clearing after system reboot? Thanks!

[Cavallonzio]

Did anyone figured out how to use crontab? it is wiped after reboot and i really need it

[Charles]

We need to put the system into Read Write Mode before changing the crontab
If you followed this tuto should be something like that

sudo mount -o remount,rw /

Then edit your crontab

sudo crontab -e

put pack in Read Only or reboot

sudo mount -o remount,ro /

[Damian Mac]

Charles you are going wrong. crontab -e give us file on /tmp which has been deleted on boot. We need to go this way:
rw
sudo su
nano /etc/crontab (dont forget to add user) example below:

• • • • • root /usr/bin/vpncheck.sh > /dev/null 2>&1

[Neoromantic]

Hello Charles,
I was wondering if I don't have entry about /tmp being a mount entry point for tmpfs neither in fstab nor mtab, what would be the point in moving things there? Am I missing something or?
I am playing with Raspberry PI-2 and Raspbian Jessie.

[ricky]

This post is deleted!

[Rok Jarc]

Great article, thanx! To be able to use sudo i did have to add this line to /etc/fstab as well:

tmpfs /var/lib/sudo/ts tmpfs nosuid,nodev 0 0

[dev]

Has this tutorial worked for anyone? The 1st error is saw was under Move files to temp filesystem after running:

touch /tmp/dhcpcd.resolv.conf; ln -s /tmp/dhcpcd.resolv.conf /etc/resolv.conf

Failed to create symbolic link ‘etc/resolv.conf’ file exists. Next after reboot see errors regarding “a start job is running for dhcpd on all interfaces..." The raspi fails to boot and see pi@raspberrypi: prompt. Thanks in advance for any insights!

[Antoine Megens]

I don't seem to be able to copy/paste from your crayon syntax highlighter widgets? The copy button doesn't work, nor does the button to expand the code.

[Piotr Mackowiak]

OK, nice tutorial. But where (I mean about file) I have to place:

rm -rf /var/lib/dhcp/ /var/lib/dhcpcd5 /var/run /var/spool /var/lock /etc/resolv.conf
ln -s /tmp /var/lib/dhcp
ln -s /tmp /var/lib/dhcpcd5
ln -s /tmp /var/run
ln -s /tmp /var/spool
ln -s /tmp /var/lock
touch /tmp/dhcpcd.resolv.conf; ln -s /tmp/dhcpcd.resolv.conf /etc/resolv.conf

[Elliott Balsley]

Nice guide. I used it on Stretch.

• I had to symlink /var/lib/sudo/ts to /tmp because it gives an error every time running sudo, then I made a systemd service to make that folder
• The /tmp/random-seed file does not get created at startup, even though I added the ExecStartPre line. It says success, but I can't figure out why that file isn't being created:
  Process: 97 ExecStartPre=/bin/echo a > /tmp/random-seed (code=exited, status=0/SUCCESS)
• Stretch uses systemd-timesyncd, so there's no need for ntp and it would conflict.
• I like the bash_logout idea to mount ro, but it fails because mount: only root can use "--options" option
• Fail2ban isn't working. Anybody know if it's possible to configure that to monitor the busybox ring buffer?

[HemantJoshi]

I am following this article in order avoid any/every write to /var/log/ (for example /var/log/wtmp, /var/log/last.log etc.
Is it possible?

Note that by disabling rsyslog.service, I could suppress write to messages and syslog files.

Using systemd mask operation I could mask systemd-update-utmp.service and systemd-update-utmp-runlevel.service. However the wtmp and lastlog files are still updated.

Please advise.

[hernaninf]

Great article, thanks! Can I use this tip to make a Pi print server for some voucher printers and it stay well when it be turned off? Do you suggest some type of memory to be installed on Pi in order to run this way?