How do I hide/anonymise/defend a computer when on hostile networks?

Question

I connect to a lot of open networks when I'm pootling around. I'm fairly careful to VPN home for anything important but that's not really my boggle. The laptop runs several services (nfs, dev http server, samba, avahi).

Not only do I not want people on open networks connecting to these services, some of them (samba and avahi) are extremely slutty and advertise themselves all over the place to other computers.

I also don't want my computer name available in public places. I already rotate random MAC addresses so hotspot owners can't track where I go on a day-to-day basis. Yeah, I'm pretty paranoid sometimes.

Is there any way I can stop these services communicating (either way) on any network that isn't home?

Answer 1

This sounds like a job for dramatic pause, Iptables!

You can drop packets for those services using the OUTPUT chain, and can use the INPUT chain to block people from communicating with these services while still allowing yourself to communicate with them (eg. Via loopback address).

There are enumerable howto's and documentation pages out there about configuring Iptables, so I won't go into extensive detail here.

Answer 2

I'm pretty sure the wifi hotspots get your hostname through your computer's DHCP client, which is dhclient in Linux.

I think with the appropriate send options in dhclient.conf you can have Linux tell the wifi hotspot's DHCP server any hostname you like.

However, writing a short script to select a random name from a file, and then execute the hostname command may be easier, though. If you do this, I would scour the net for a good list of default hostnames and choose from there. A hostname in a wifi hotspot's DHCP logs that looks like "FJkhKDFJGH$K%^FH^KJDFHKHDFKJHDF" is going to stand out among all the "Marlene-PC" and "My_Laptop" hostnames.

Also when selecting random MAC addresses, try to pick from a pool of actual devices that appear in laptops. Don't set your MAC address to a purely random MAC or that of something like Cisco routers or something obviously bogus. This will further contribute to your obscurity.

@Jeff Welling is right about iptables. It's not difficult to create a couple of INPUT chain rules that drops all incoming traffic unless your incoming interface's IP is that of your home connection, or within a range you specify (use whois on your own IP to get your ISP's subnet).