Everyone using Raspberry Pi's knows that SD cards are actually not made to serve as storage, especially when storage intensive applications (e.g. database, log server...) are being put in-there. To limit this SD wearing (which will lead to SD corruption at some point), you can put Raspian in a read-only mode and only swith to read-write when really needed.
All kudos go to this
blog for the excellent write up. I assume you have an RPi3 with Wheezy installed onto it. All commands are executed as root.
Update your RPi
Make yourself root, update your Raspian and reboot.
su -
apt-get update && apt-get upgrade
reboot
Remove some unwanted packages
apt-get remove --purge wolfram-engine triggerhappy anacron dphys-swapfile xserver-common lightdm
insserv -r x11-common; apt-get autoremove --purge
Replace the Rsyslog with the Busybox one
apt-get install busybox-syslogd; dpkg --purge rsyslog
Disable swap and filesystem check and set it to read-only
Edit the file: /boot/cmdline.txt and add the three words
fastboot noswap ro
Move some system files to the temp filesystem
rm -rf /var/lib/dhcp/ /var/run /var/spool /var/lock /etc/resolv.conf
ln -s /tmp /var/lib/dhcp
ln -s /tmp /var/run
ln -s /tmp /var/spool
ln -s /tmp /var/lock
touch /tmp/dhcpcd.resolv.conf; ln -s /tmp/dhcpcd.resolv.conf /etc/resolv.conf
Change the dhcpd lock file to the temp filesystem
vi /etc/systemd/system/dhcpcd5
And be sure to change the line with PIDFile=/run/dhcpcd.pid to PIDFile=/var/run/dhcpcd.pid
On Debian Jessie and Wheezy move random-seed to a writable location
rm /var/lib/systemd/random-seed
ln -s /tmp/random-seed /var/lib/systemd/random-seed
Since this file is on tmpfs, it will not be created upon reboot, but we can still do this with some magic of the systemd system service.
To create file on the tmp area at bootup before starting the random-seed service, just edit the file service file to add a pre-command to execute:
vi /lib/systemd/system/systemd-random-seed.service
Add the line: ExecStartPre=/bin/echo "" >/tmp/random-seed under the service section.
Do not use touch instead of echo, it won’t work because we'll be checking a read-only filesystem.
Execute the following to tell systemd we made changes.
systemctl daemon-reload
Setup the Internet clock sync
If (still) needed install NTP
apt-get install ntp
And be sure to configure your time zone, with raspi-config tool.
raspi-config
Then go to menu "Internationalisation Options" and change "Change Timezone" and select your time zone.
Edit the hourly cron script that saves the clock every hour
vi /etc/cron.hourly/fake-hwclock
And change it to allow saving the clock.
#!/bin/sh
#
# Simple cron script - save the current clock periodically in case of
# a power failure or other crash
if (command -v fake-hwclock >/dev/null 2>&1) ; then
mount -o remount,rw /
fake-hwclock save
mount -o remount,ro /
fi
Edit the file /etc/ntp.conf and set to redirect driftfile to the writable zone /var/tmp
vi /etc/ntp.conf
Remove some startup scripts and edit fstab
insserv -r bootlogs; insserv -r console-setup
Edit fstab and add the ro option. Add the tmpfs parts as well.
vi /etc/fstab
tmpfs /tmp tmpfs nosuid,nodev 0 0
tmpfs /var/log tmpfs nosuid,nodev 0 0
tmpfs /var/tmp tmpfs nosuid,nodev 0 0
Reboot
reboot
If all went fine, you're pi will be up again. Test if the filesystem is read-only now.
Switching from read-only mode to read-write and back
Now you’re in read-only mode, it’s fine and safe, but if you need to install, write or modify files, upgrade, or whatever that need write access, you'll need to be able to do this.
To set system to read-write:
mount -o remount,rw /
And to set it back to read-only:
mount -o remount,ro /
If you want to have two simple commands like: ro for setting mode to read-only and: rw to enable read-write mode. I also want to know on which mode I am in, on the command prompt.
Add fancy indicating features
Edit the file bash.bashrc
vi /etc/bash.bashrc
At the end add the following lines:
# set variable identifying the filesystem you work in (used in the prompt below)
set_bash_prompt(){
fs_mode=$(mount | sed -n -e "s/^\/dev\/.* on \/ .*(\(r[w|o]\).*/\1/p")
PS1='\[\033[01;32m\]\u@\h${fs_mode:+($fs_mode)}\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\$ '
}
alias ro='sudo mount -o remount,ro / ; sudo mount -o remount,ro /boot'
alias rw='sudo mount -o remount,rw / ; sudo mount -o remount,rw /boot'
# setup fancy prompt"
PROMPT_COMMAND=set_bash_prompt
Execute this new file and look at the magic! The prompt has changed and shows the file system mode.
. /etc/bash.bashrc
Test by typing ro or rw to switch between modes.
Use logout to save history and force read-only mode
To be sure to avoid setting back to read-only at logout, add the following line to the file
/etc/bash.bash_logout. (maybe you'll need to create it)
vi /etc/bash.bash_logout
Add:
mount -o remount,rw /
history -a
fake-hwclock save
mount -o remount,ro /
mount -o remount,ro /boot
