A fail-safe for changing network config on headless servers

Lenovo Tiny PC

I’ve been setting up a Lenvo tiny system, which came with an M.2 wifi card. I’m going to probably replace it with another Intel GB / 2.5 GB adapter at some point, but right now I don’t really have a reason to. It is always a little scary when you make major changes to your network configuration on a headless system. This box isn’t physically far away, but it is indeed tucked away in another part of the house and I have no desire to bring a monitor over to it.

I realized, the wifi could serve a purpose in case I bork the bridge config somehow, or something unexpected breaks my configuration. Because I used wifi for the Debian netinstall, ifupdown already connects to wifi on boot, so there’s my failsafe. However, I don’t want or need that to stay up after the wired network is up. So I came up with this:

@reboot sleep 60 && ping -c 3 -I br0 10.0.0.1 >/dev/null 2>&1 && ifdown wlp2s0

Put this in root’s crontab, 60 seconds after cron starts it will try to ping something on the LAN, trying three times. If it can ping successfully, we bring down our backup interface. Beautiful.

This would make even more sense with a cheap USB network adapter just to have a failsafe if you’re experimenting and don’t want to lock yourself out of a system without a monitor (or even a physical serial port, for that matter).

Fail-safe, for what? – long version, for those so-inclined

Well, I wanted to be able to easily network some VMs on this thing, so I set up bridged networking. For those who don’t know, this is how Proxmox lets your VMs basically all share a NIC and each get a DHCP lease from your main network, no double-NAT nonsense, and no need to configure static routes either. I briefly did try ProxMox on this thing, and not to talk down of it but there is a reason I don’t use it… has way too much going on out of the box that I’ll never use. It is a great product, and it definitely has its place but I like the minimal-manual style of setting things up. If I wanted to take advantage of the cluster / high availability features or ZFS snapshots then it is a great way to save you a ton of hassle manually setting up some pretty complicated stuff… But I’m not doing anything that fancy. Proxmox IMO is overkill if you just need to run a few VMs, jails or containers. It is convenient as a “poor man’s KVM” though.

Thanks to Mozilla’s PR Nightmare…

Google Warning

When the words “New sign in” are in the same message as “Windows”, something probably isn’t good! If you’re like me anyway

My heart just about stopped seeing a new sign in from Windows pop up as an alert. I did some digging, and quickly noticed that it must be a mistake… TLDR; it was.

Because Mozilla managed to piss off the entire internet with their new Terms of Service, updated to comply /w California law, I gave LibreWolf a spin… and signed into a google service at some point.

Much to my relief, I did NOT get hacked. Librewolf reports a Windows user-agent. Yes, even on Linux. I mean, from a privacy standpoint I don’t care & it does make sense. Linux users are only 2% – 4% of the desktop market share, so looking like another Win user is good if you want to be further anonymous.

Anyways, Louis Rossman has a really good take on the whole situation… The video is worth a watch. I’ll likely ditch FireFox in time, but this whole debacle isn’t as bad as it first seemed thankfully. Video Link

Just had to share this though… Because you know, the same thing happened to more than just me!!

Browser Crashing X.Org — Not on Alpine!

Alpine Linux
Wanted to make a note of clarifying a post I made on the former weblog back on Feb 2nd: “Firefox Crashing X11”

In that post, I explain that my T400 ThinkPad experiences X.org crashes on average once or twice a day. This was on both Debian 12, and FreeBSD 13. On FireFox from the main repo, FF ESR, and even on the latest FireFox which I went out of the way to get V134 set up on Debian Stable. I thought this fixed the problem, but I was wrong.

Pretty sure it has something to do with the machine’s ancient GMA 4500 (or the 915 driver) and some GL stuff which when it tries to run, X just immediately crashes.

Just wanted to say that I’ve been running Alpine Linux on the old ThinkPad, and my web experience has been rock solid. No more issues. I occasionally boot back into Debian, and still happening there but whatever. At some point I’ll do the necessary digging if the problem persists so I can properly report the bug.

But anyway, Debian is nice for old machines. Debian without systemd is quite light and nimble, indeed. But Alpine? Alpine is like an arrow and a feather, as one. HIGHLY recommended! I’ve been running it off a 16 GB SATA DOM in the ultra bay. https://alpinelinux.org

Site Upgrades: Better Blogging!

I really have to say, I am absolutely impressed. Long have I been wanting some CMS to save me the hassle of building everything from scratch, but it always seemed that I’d try out something either beyond overbuilt, full of things I didn’t need and more importantly didn’t want.

WordPress seems to be the de-facto standard in this game, and for what it is, it is pretty good. But is isn’t for me.

WriteFreely seems quite different… we’ll see how things go!

Firefox is Crashing X.Org on my Thinkpad T400… Why?

X.Org

Only had the issue on my T400, but it was an issue under FreeBSD 13.4 /w the FireFox/FireFox ESR available from pkg… and the same darn thing is happening with Debian Bookworm. I’m wondering if the ancient Core 2 Duo is playing a role here… (tries to do X unsupported thing… & crash. ?)

Mostly when doing a search on google… and you click a link and BAM, back to the tty. (or login greeter screen)

Not the browser crashing either, when this happens it kills the whole X server. So not cool! Luckily I didn’t loose any work when this happened, and it has happened about half a dozen times or more. Saving frequently saves the day. I thought I was getting somewhere when I saw a post about trying to disable the HW acceleration option in FF preferences, and I did try. Unfortunately though, no luck.

Something did seem to work though, using the latest FF package from Mozilla. Here is an excellent, easy to follow cut & paste to get you the latest Firefox on Debian: https://support.mozilla.org/en-US/kb/install-firefox-linux

That got me to v 134, and the problem appears to be gone.

UPDATE: THE PROBLEM STILL HAPPENS on v 134 Sorry.

My Thoughts on OpenBSD

Puffy
A completely FREE, multi-platform 4.4BSD-based UNIX-like operating system with a strong focus on proactive security and integrated cryptography.


First of all, I’m going to disclose that
I haven’t really used OpenBSD extensively for my daily computing. While I’ve installed it several times, I always ended up choosing something else in the end. I was particularly interested in trying it out on my web server and even thought about using it on my ThinkPad. The installations went smoothly, and the hardware was well-supported. These are my thoughts on OpenBSD, why I’m not using it right now and why I may use it in the future.

    Setting up OpenBSD with a graphical X11 desktop, FVWM window manager, and xenocara display manager is surprisingly easy, even for someone without any previous experience. It’s straightforward to get started, and the default security measures can be a definite plus. However, to use it effectively without these features becoming a hindrance, you need to understand the relationship between OpenBSD and their vision of a secure Unix sytem.

    When it comes to partitioning, OpenBSD’s approach to partitioning is definitely not much like your typical modern Linux distribution. If you’re used to the very simple, one size fits all with just a big root (/) and maybe a couple GB for swap, this may seem foreign. Each partition should be sized carefully.  They’ll have their own unique locked down permissions, which can enhance security. For example, an X11 installation typically remains stable in size, including a little wiggle room for updates. While all Unix-like systems use permissions, OpenBSD takes it to another level. This can be great for security but requires some learning to manage effectively.  This table from their manual page does a much better job as a visual representation than anything I could put into words.

 

“The exact set of partitions created depends on available free space, how fragmented the free space is and some machine dependent variables, but will be approximately (as follows)”

> 10GB Free > 2.5GB > 700MB < 700MB
/ 150MB –   1GB 800MB –   2GB 700MB –   4GB 1MB – 2GB
swap  80MB – 256MB  80MB – 256MB   1MB – 256MB
/usr 1.5GB –  30GB 1.5GB –  30GB
/home   1GB – 300GB 256MB –   2GB
/tmp 120MB –   4GB
/var  80MB –   4GB
/usr/X11R6 384MB –   1GB
/usr/local   1GB –  20GB
/usr/src   2GB –   5GB
/usr/obj   5GB –   6GB

Source: Disk Allocation, The OpenBSD Man Page
Server [
link
]

 

    This will be a common theme on OpenBSD. Security. You’ll definitely see that given the option, most things will take the back seat to security if the choice arises. This isn’t a bad idea, but I can see how some people get the idea you’d have to be at least a little paranoid to want an OS as locked down and granular as this one. Or Maybe I’m just a s*** sysadmin?? Never the less…

Personally, my main gripe is that I can be quite particular about certain things. I prefer not to set half a dozen just shy of a dozen static partition sizes that can’t be easily adjusted later without redoing others. I don’t want to spend hours researching and comparing just to get everything perfect! You can opt for auto-partitioning, which I recommend, but depending on your disk size, adding extra packages can be hit or miss. I did an install on a 16 GB SSD recently and found that I was quickly completely out of room after installing an additional desktop environment and web browser. I’ve used the same tiny SSD without incident on Debian and FreeBSD with many more applications installed, so it is down to the partitioning. I can’t really fault OpenBSD for this, because I’m the lazy hack that wanted auto-partitioning, but my point is some things just don’t need to be so complicated.

Installing software is straightforward, although OpenBSD has its own rules. For instance, if I recall correctly, only members of staff can allocate more than 1024 MB of memory to their processes. This detail is crucial for tasks like running a database server or even just using Firefox with multiple tabs. This is very easily changed by simply editing a config file, but it is something to be aware of.

As for customization, OpenBSD is a lean and clean OS that offers a high degree of fine-grained control for those willing to invest time in learning it. However, for my needs, FreeBSD and Linux seem to have fewer complexities, and I find it hard to justify the time required to master OpenBSD. For something like a server I could see the initial time investment paying off in return for a long and secure service life.

Some of OpenBSDs features wont appeal to everyone. For instance, hyper-threading is disabled by default to enhance security against CPU exploits related to side-channel attacks. While this is a prudent security measure, it may impact performance. OpenBSD, despite being lightweight, might be less performant than FreeBSD or Linux in similar scenarios. Nevertheless, if OpenBSD’s security model aligns with your needs, performance considerations may become less critical.

    Overall, I think OpenBSD is fantastic. However, it’s not my go-to choice for my main machine. I have considered using it for a web server where maximum performance isn’t critical, as my server typically only deals with a load at a fraction of its capacity. OpenBSD is undeniably a robust and secure Unix-like operating system, with excellent documentation and from what I’ve heard some very clean code. To those interested; I’d definitely recommend that you check it out. Ironically, in light of any complaints I have stated above it really is probably the easiest BSD system to get up and running with a full graphical desktop.

 

Read more about:    Operating Systems    Software

XScreenSaver Install Script for Debian MATE Desktop

XScreenSaver

MAKING IT BE (a little) LESS PAIN IN THE ASS

If you’re using Gnome/MATE screensaver (or locker), I’d recommend you don’t. Weather it is because you value X locking security, or just admit it they’re cool screensavers, toss that in the bin and install the real deal.. XScreenSaver.

I have written a script which takes care of all of the following:
1. On Debian, XScreenSaver needs you to manually specify 4 packages to get the program, “extra” savers, gl savers, and “gl extra” savers. This will get you the complete collection, as the author distributes it.
2. Remove MATE Screensaver
3. Apt pin / pref so MATE Screensaver isn’t reinstalled next time you run apt, because MATE Desktop thinks it needs it
4. Autostarts XScreenSaver
5. makes a soft link so you can still lock from the “System” menu up top, and click “Lock Screen”. Now XS will do it.

This will save me HOURS over time.

Get it here: http://lostgeek.net/files/xscreensaver-mate.sh

The PiFrame — Pi Zero 2 LCD Weather Clock


The
          PiFrame

   Raspberry Pi Zero 2 WH — $18
I2C 20×4 LCD Display — $5
Shadowbox Frame — $7

Doing a geeky project for under $30?? Priceless…

Ah, the Raspberry Pi. That $35 single board computer everyone was scalping for 3x what they were worth during the chip shortages. Well, I used to own several of them… and unfortunately no longer do. I will say, for the MSRP price they aren’t a bad option. The whole ecosystem is quite attractive for many reasons, and the brand receives praise left and right for it. I will indeed say, they’re basically swiss army knives for a hacker. A whole miniature linux system, with a quad core 64 bit CPU and often 1 – 4 GB of RAM. IMO the 8 GB is a waste of money, of course, I tend to like lean configurations so perhaps I just feel that way because I’d never use 4 GB on a Pi let alone 8. AND, if I did need 8 GB or more, I’d use a DDR4 mini PC, not a Pi!

Anywho, in the spirit of what the Pi is all about, I wanted something cheap to hack on. I have a Pi 5, but it pulls full time duty as a server. And, what can I say? It works so well for this, and the small size and lower power requirements are part of that attraction for me. Now, PCIe gigabit ethernet, and PCIe NVME storage are a pretty strong motivation for my willingness to keep the Pi 5 4 GB I’ve got employed as a server. Without those, I’d use a thin client or old laptop in a heartbeat. Oh yeah, the spirit of the Pi, that’s where I started blabbing right?

So the Pi Zero, it’s like an original 2012 Pi, but with optional Wifi. You loose onboard ethernet (but it was USB anyway on the early models, and you do have a USB port to add a NIC…) but you get a very small package still boasting full 40 pin GPIO. They refreshed the Pi Zero in late 2021 with the Pi Zero 2. If you want WiFi and BT, you want the Zero 2 W. Want pre-soldered GPIO pins too? Get the WH.

** NOW a little PSA here, I bought a Pi Zero 2 WH on Amazon… so that came /w a soldered GPIO pin header. Quite handy, even has color coded spots at the base of each pin so you know what is GPIO, 5v, Ground, etc… Except, mine was put on upside down. Took me forever to figure this out, and I would have been pretty pissed if I needed to RMA it because some shoddy reseller is doing these headders themselves to save 30 cents and mislabeling the pins. I don’t care now that I know, but being largely for the education market this is a bit discouraging to see. If I were in the same situation as a young kid, the Pi may very well have gone in the bin.

You can get a pack of two 20 character / column x 4 row LCD screens, with pre-soldered i2c “backpack” for about ten bucks. And, you can get it in green, red, blue, whatever you want. I went with the OG, green LCD.

Let there
        be light!

So… what does it do? Well, it’s an excuse to have another Linux box in your fleet, I mean, what more do you want?? But since you asked, it does anything you tell it to. Right now, mine spends five seconds showing me the date, time, and my web server uptime. Then it shows me local weather for another five seconds. There’s more in the pipe though, and trying out new code is incredibly easy.

LCD
        Display LCD Display

What makes this clock… tick?? Python.

#!/usr/bin/env python

import drivers
from time import sleep, strftime
import argparse
import requests
import subprocess

def get_uptime():
    try:
        # Run the 'uptime -p' command and capture the output
        #result = subprocess.run(['uptime', '-p'], capture_output=True, text=True, check=True)
        result = subprocess.run(['cat', '/tmp/uptime'], capture_output=True, text=True, check=True)
        uptime_str = result.stdout.strip()  # E.g., "up 1 day, 1 hour, 45 minutes"
        
##        # Use awk to format it as "up 1d 1h 45m"
##        formatted_uptime = subprocess.run(
##           ['awk', '{print "WWW up ", $2 " weeks", $4 "d", $6 "h"}'], input=uptime_str, text=True, capture_output=True
##        ).stdout.strip()

## The above works, when you've had < 7 days up... then we need the following... (and yes, I could have made this MUCH more elegant)

        # Use awk to format and convert weeks into days, then calculate total days
        formatted_uptime = subprocess.run(
            ['awk', '{week_days=($2*7); total_days=week_days+$4; print "HTTPD.lan up", total_days "d", $6 "h"}'], 
            input=uptime_str, text=True, capture_output=True
        ).stdout.strip()
        return formatted_uptime

    except subprocess.CalledProcessError as e:
        print(f"Error getting uptime: {e}")
        return "Uptime not available"

# Load the driver
lcd = drivers.Lcd()

# Weather API settings
API_KEY = "000000000000000000000" ## The API keys are free, just sign up. Painless or I wouldn't have bothered.
ZIP_CODE = "00000" ## Your Zip code here!
COUNTRY_CODE = "US"
WEATHER_URL = f"http://api.openweathermap.org/data/2.5/weather?zip={ZIP_CODE},{COUNTRY_CODE}&appid={API_KEY}&units=imperial"

# Function to fetch weather data
def get_weather():
    try:
        response = requests.get(WEATHER_URL)
        data = response.json()
        if data and data["cod"] == 200:
            temp = round(data["main"]["temp"])
            humidity = data["main"]["humidity"]
            wind_speed = round(data["wind"]["speed"])
            wind_dir = data["wind"].get("deg", "N/A")
            return temp, humidity, wind_speed, wind_dir
    except Exception as e:
        print("Error fetching weather:", e)
    return None, None, None, None

# Parse command-line arguments
parser = argparse.ArgumentParser(description="LCD Display Script")
parser.add_argument("--wc", action="store_true", help="Only display weather and clock pages in rotation")
args = parser.parse_args()

try:
    while True:
        # Date/Time page
        lcd.lcd_clear()
        lcd.lcd_display_string(strftime("Today is %A,"), 1)
        lcd.lcd_display_string(strftime("     %B %d"), 2)

        # Display uptime on the 4th row
        uptime = get_uptime()  # Call the function and store the uptime
        lcd.lcd_display_string(f"{uptime}", 4)

        # Continuously update the time (third row)
        for _ in range(10):  # Display for ~10 seconds
            lcd.lcd_display_string(strftime("     %I:%M:%S %p"), 3)
            sleep(1)

        # Weather page
        if args.wc:  # Include weather in both modes (if --wc is passed)
            temp, humidity, wind_speed, wind_dir = get_weather()
            if temp is not None:
                lcd.lcd_clear()
                lcd.lcd_display_string("    Boscawen, NH    ", 1)
                lcd.lcd_display_string(f"    Temp: {temp}F   ", 2)
                lcd.lcd_display_string(f"   {humidity}% Humidity", 3)
                lcd.lcd_display_string(f"  Wind: {wind_speed}mph", 4)
                sleep(5)

except KeyboardInterrupt:
    print(" ~ Clearing ~ ")
    lcd.lcd_clear()

Now, I’m not really much of a programmer. Nope. But, ugly or not there it is. I suggest you do what I did, and start here: The Raspberry Pi Guy has a page with sample code and some other helpful stuff on Github. Using the 16×2 code on a 20×4 is as easy as changing 16 to 20 and 2 to 4. Well, gotta add lines 3 and 4 below 1 and 2. But not rocket surgery.

I recommend using the overlay FS and read only /boot partition if you do something like this to avoid accidental SD card filesystem corruption from unsafe shutdowns. I actually added a systemd service so that on target of reboot, halt or shutdown a shell script will kill the python process, then launch another which blanks the screen and replaces the text with “IT IS NOW SAFE TO TURN OFF YOUR COMPUTER” — if you know, you know. About 1 second after that hits the LCD, the Pi powers off and the Act LED goes dark. The LCD will stay lit, and retain the last thing printed on it as long as power is connected.

Now, the BEST thing to do for your filesystem / SD card is to power off via SSH before unplugging any Pi. However, to power my “clock” up, all I do is plug it in. If you put in your crontab a line starting with @reboot, you’ll be able to easily start scripts at boot. I did this as root, because I think you need to be root to use the GPIO. Probably a way around this, but this runs nothing other than the display stuff at the moment.

Cron on the Pi Zero 2 W. aka PiFrame:
@reboot /root/lcd/bens3.py –wc
@reboot curl -s https://ben.lostgeek.net/uptime.txt -o /tmp/uptime
0 * * * * curl -s https://ben.lostgeek.net/uptime.txt -o /tmp/uptime

What this does is at boot, we pull uptime from a text file on my webserver and we start up the python program with the –wc arg, “weather clock”. This applies to the code above, so I left it as is. Only one more part is needed.

Cron on the server:
0 * * * * uptime -p > /var/www/html/ben/uptime.txt

This puts an up to date uptime file in my web directory once an hour. And the keen observers among us probably noticed that the Zero also will refresh this information at the top of each hour too. Easy peasy.

Raspberry Pi 5 PCIe Gen 3 Follow-Up

Good News,

Perhaps you’ve read my last article related to the Raspberry Pi 5, where I explore what kind of NVMe SSD experience one can get for a mere $25 or less spent on Amazon. And, the TLDR is that for under $25 I was able to purchase a brand new PCI-E M.2 HAT for the Pi 5, as well as a name brand Gen 3 128 GB SSD. The SK Hynix SSD was not brand new, it was pulled from something but SMART showed that it had less than 300GB written to it, so IMO absolutely worth buying.

So in that write up, I discuss the PCI link speed situation… basically, the Pi is only certified for Gen 2… but Gen 3 offers nearly double the speed! Immediately, I was conflicted. Even at Gen 2 speed, this already beats using SD card storage by a MILE. Way more reliable, MUCH faster, and much larger. There is no down side, other than costing a small bit more. Since this runs my server, I could have happily stuck with Gen 2 and still gotten more than my money’s worth in terms of bang-for-buck computing goodness out of the upgrade. However, many folks on the net reported no issues whatsoever running at 3.0 link speed, so I figured I’d try it, run several benchmarks, use it for several days. If I saw even one error, minor or otherwise, Gen 3 would be officially off the table.

Now, I’d be willing to bet that what I did next was not entirely necessary. But basically, there are some files you can read back from a system directory in linux which will tell you if you’re having NVME errors. Non-volatile memory advanced error reporting, or NVMAER for short. I go into more detail in the original article.

I run many scripts via cron on this machine. The ease of scripting as a sysadmin’s tool is a large part of what makes *nix such an excellent platform for power users. So… I wrote up a script, which runs once per hour. It checks for any of three types of NVMAER errors; when it does this, it appends a time stamped line to a log file stating wether or not it found errors. If It does find any, it will say which kind of errors they were, and I’ll know WHEN they happened.

Now, I’m sure what I am doing here is entirely redundant. I’d be very surprised if the system logs don’t already store all this and more, but it doesn’t tax this system to run a small script once per hour, and it gave me more confidence that if anything wonky did happen at Gen 3 speed that I wouldn’t possibly miss it! The last thing I wanted was to have minor errors which weren’t obvious, then down the road I end up with corrupt files.

I figured I’d share that script, because it came out pretty clean. And, it is a really good example of how one can go about building the tool, which solves a given problem. The multiple error types which are possibly made it just interesting enough, in my opinion. AND, even if this may be entirely redundant, just the ease of use made it worth it for me. So maybe you’ll find it of use yourself if you’re also self-validating PCIE 3 speeds on your Pi 5 SSD.

#!/bin/bash

LOGFILE="/var/log/cronlog/nvmaer.log"   # Log file. You'll want to change this! The directory must already exist.

# Define color codes
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Current date
DATE=$(date)
LOG_DATE=$(date +"%m/%d/%Y %H:%M")
echo "CHECK DATE: $DATE"

# Initialize variables
exit_code=0
log_entry=""

# Function to check errors
check_errors() {
    local error_type="$1"
    local file_path="$2"
    
    echo "Checking for $error_type errors..."
    
    # Capture the output of the command
    errors=$(awk '$2 != 0' "$file_path")
    
    # Check if errors is empty
    if [ -z "$errors" ]; then
        # No errors found
        echo -e "${GREEN}PASSED${NC}"
        log_entry+=" $error_type PASSED"
    else
        # Errors detected
        echo -e "${YELLOW}ERRORS DETECTED!${NC}"
        echo "$errors"
        log_entry+=" $error_type ERRORS DETECTED!"
        log_entry+=$'\n'"$errors"
        # Set the exit code to indicate problems
        exit_code=1
    fi
    echo "- - - - - - - - - - - - - - - - - - - -"
}

# Check for FATAL errors
check_errors "FATAL" "/sys/devices/platform/axi/1000110000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/aer_dev_fatal"

# Check for NONFATAL errors
check_errors "NONFATAL" "/sys/devices/platform/axi/1000110000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/aer_dev_nonfatal"

# Check for CORRECTABLE errors
check_errors "CORRECTABLE" "/sys/devices/platform/axi/1000110000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/aer_dev_correctable"

# Log results
if [ $exit_code -eq 0 ]; then
    # No errors detected
    echo -e "CHECK $LOG_DATE -- NO ERRORS, ${GREEN}[CHECK PASSED]${NC}" >> "$LOGFILE"
else
    # Errors detected
    echo "$log_entry" >> "$LOGFILE"
fi

# Exit with the appropriate exit code
exit $exit_code

Original article: https://lostgeek.net/pi5nvme

Trimming the fat from Raspberry Pi OS Lite

Some of you may know that I host this website on a Raspberry Pi 5. I use Raspberry Pi OS Lite, which is a minimal Debian-based operating system that is lean and minimal without excluding anything that would break any features of the Pi itself. I’ve got the 4 GB model, and I don’t think I’ve ever used more than 400-500 MB of RAM during normal server operation. So why slim it down even more? Well, more software equals a larger attack surface, more potential software bugs, and so on.

In a situation where I’m never using the built-in WiFi and Bluetooth radios, there’s no benefit in having their drivers loaded into the kernel. Having unused code running can only increase the likelihood of exploitation, unexpected behavior, bugs, or other unwanted results. These devices also consume power, albeit a small amount, and probably even less when they aren’t connected to a network or device.

Now, I’ve found the drivers on the Raspberry Pi to be pretty good. Honestly, I’ve never had an issue. But since I’m literally not using any wireless on this thing—it’s connected to my network switch with less than a foot of Cat6 Ethernet cable—why bother? If nothing else, you’ll free up a few megabytes of memory. Perhaps an even more tangible benefit is having fewer items cluttering your systemd services and process lists when you check with top or htop.

After removing the following, I saw my memory usage drop to just 125 MB initially. That’s 125 MB of memory used while running Debian 12, with my Apache2 HTTP/HTTPS server and Pi-hole DNS. That’s not bad—kind of impressive, actually!

  • Stopped & Disabled:
    • Audio (via config.txt)
    • avahi-daemon
    • bluetooth
    • ModemManager
    • NetworkManager
    • triggerhappy
    • wpa_supplicant

Most of these are self-explanatory. As for the less obvious names, avahi is sort of like Apple’s Bonjour service; it’s for mDNS/local device discovery. I knew I didn’t need it, but if you’re not sure, leave it alone. Triggerhappy is a hotkey daemon, which is an easy one to disable on my totally headless system. Audio can be disabled by commenting a line in /boot/firmware/config.txt:

dtparam=audio=off`

And since I was in there anyways, I also commented a couple other lines:

camera_auto_detect=1
display_auto_detect=1

ModemManager, Bluetooth, and wpa_supplicant can just be turned off if you don’t plan on using WiFi or Bluetooth.

sudo systemctl stop ModemManager
sudo systemctl disable ModemManager

Repeat the same two commands for the other daemons.

Now, I’m not making this a full tutorial, and there are two reasons for that. For starters, I’m feeling kind of lazy, and I don’t want to have to redo everything to make sure my directions are 100% correct.

If you want to get rid of NetworkManager too, you’ll want to set up networking manually first. In my case, I edited /etc/network/interfaces and added the following:

auto eth0
iface eth0 inet static
address 10.16.17.10/23
gateway 10.16.16.1
dns-search lan
dns-nameservers 10.16.16.1

If you’re not sure, just leave NetworkManager installed. In my case, I went with a static configuration because I didn’t want to have a daemon running for the DHCP client. If your subnet mask is 255.255.255.0, you would use /24.

But the other very real reason is: If you’re not confident yet in how to disable these things, you probably shouldn’t. Do a bit more research first anyways.

When making changes to your system, have an up-to-date backup because you never know when a change could leave you with a non-booting system. Also, when changing the networking system, it should go without saying that doing so can leave you locked out of a headless system. So only proceed if you have a means of getting back in to fix it should you mess up.

This is really more of a journal of my experience setting this up, for those with some experience to get ideas from. It isn’t meant as a tutorial by any means. I just wanted to share how I got my idle RAM usage down to 3%, with my services running.

© 2025 LostGeek.NET - All Rights Reserved. Powered by ClassicPress, NGINX, Debian GNU/Linux.