KDE Connect is a great piece of software, but not everyone will want to have a server open, as this increases the attack surface, and at least in the past was a vector for a DOS attack
I only found really weird ways how to disable it, like making the binary nonexecutable. But I would like a good way, it doesnt seem to have a systemd service.
The use case is for the security-hardened OS secureblue, based on Fedora Kinoite in that case.
Apart from blocking it behind a firewall, is there a way to actually disable it normally, without needint to uninstall it, to allow easy on/off switching?
Since kdeconnect is dbus activated it is relatively hard to make sure it stays stopped so the brute
force approach is to uninstall the kdeconnect package from your system and then run
kquitapp5 kdeconnectd
Just install the package again once you’re back in a trusted network.
Operating System: openSUSE Leap 15.5
KDE Plasma Version: 5.27.9
KDE Frameworks Version: 5.103.0
Qt Version: 5.15.8
Kernel Version: 5.14.21-150500.55.36-default (64-bit)
And, looking at the KDE Bug Report, I’m a bit puzzled as what other distros are doing with respect to package dependencies –
# LANG=C zypper remove --clean-deps kdeconnect-kde
Reading installed packages...
Resolving package dependencies...
The following 7 packages are going to be REMOVED:
kdeconnect-kde kdeconnect-kde-lang kdeconnect-kde-zsh-completion kpeoplevcard libKF5PulseAudioQt3 libfakekey0 sshfs
7 packages to remove.
After the operation, 6.0 MiB will be freed.
Continue? [y/n/v/...? shows all options] (y): n
#
> LANG=C zypper info --recommends --requires --suggests --supplements kdeconnect-kde
Loading repository data...
Reading installed packages...
Information for package kdeconnect-kde:
---------------------------------------
Repository : Haupt-Repository
Name : kdeconnect-kde
Version : 22.12.3-bp155.1.6
Arch : x86_64
Vendor : openSUSE
Installed Size : 4.1 MiB
Installed : Yes (automatically)
Status : up-to-date
Source package : kdeconnect-kde-22.12.3-bp155.1.6.src
Upstream URL : https://community.kde.org/KDEConnect
Summary : Integration of Android with Linux desktops
Description :
A package for integration of Android with Linux desktops.
Current feature list:
- Clipboard share: copy from or to your desktop
- Notifications sync (4.3+): Read your Android notifications
- Multimedia remote control: Use your phone as a remote control
- WiFi connection: no USB wire or Bluetooth needed
- RSA Encryption: your information is safe
Please note you will need to install KDE Connect on Android for this app to work:
https://play.google.com/store/apps/details?id=org.kde.kdeconnect_tp or
https://f-droid.org/en/packages/org.kde.kdeconnect_tp/
Requires : [78]
libstdc++.so.6()(64bit)
libstdc++.so.6(CXXABI_1.3)(64bit)
libstdc++.so.6(GLIBCXX_3.4)(64bit)
libstdc++.so.6(CXXABI_1.3.9)(64bit)
libc.so.6(GLIBC_2.14)(64bit)
libQt5Core.so.5()(64bit)
libQt5Core.so.5(Qt_5)(64bit)
libQt5Gui.so.5()(64bit)
libQt5Gui.so.5(Qt_5)(64bit)
libQt5Widgets.so.5()(64bit)
libQt5Widgets.so.5(Qt_5)(64bit)
libX11.so.6()(64bit)
libKF5CoreAddons.so.5()(64bit)
libKF5I18n.so.5()(64bit)
libQt5Core.so.5(Qt_5.15)(64bit)
libQt5Network.so.5()(64bit)
libQt5DBus.so.5()(64bit)
libQt5DBus.so.5(Qt_5)(64bit)
libQt5Network.so.5(Qt_5)(64bit)
libKF5ConfigCore.so.5()(64bit)
libKF5WidgetsAddons.so.5()(64bit)
libQt5Qml.so.5()(64bit)
libQt5Qml.so.5(Qt_5)(64bit)
libKF5ConfigWidgets.so.5()(64bit)
libKF5KIOCore.so.5()(64bit)
libQt5Quick.so.5()(64bit)
libQt5Quick.so.5(Qt_5)(64bit)
libKF5KIOWidgets.so.5()(64bit)
libKF5DBusAddons.so.5()(64bit)
libKF5WindowSystem.so.5()(64bit)
libQt5X11Extras.so.5()(64bit)
libQt5X11Extras.so.5(Qt_5)(64bit)
libKF5Notifications.so.5()(64bit)
libwayland-client.so.0()(64bit)
libKF5Service.so.5()(64bit)
libKF5IconThemes.so.5()(64bit)
libKF5KIOGui.so.5()(64bit)
libXtst.so.6()(64bit)
libKF5GuiAddons.so.5()(64bit)
libQt5Multimedia.so.5()(64bit)
libQt5Multimedia.so.5(Qt_5)(64bit)
libKF5KIOFileWidgets.so.5()(64bit)
libKF5Solid.so.5()(64bit)
libqt5-qtquickcontrols2
libKF5KCMUtils.so.5()(64bit)
kirigami2
libQt5QuickControls2.so.5()(64bit)
libQt5QuickControls2.so.5(Qt_5)(64bit)
libqca-qt5.so.2()(64bit)
libKF5WaylandClient.so.5()(64bit)
libQt5WaylandClient.so.5()(64bit)
libQt5WaylandClient.so.5(Qt_5)(64bit)
libKF5People.so.5()(64bit)
libfakekey.so.0()(64bit)
plasma-framework-components
libKF5PulseAudioQt.so.3()(64bit)
qt5qmlimport(QtQuick.Layouts.1) >= 1
qt5qmlimport(org.kde.plasma.core.2) >= 0
qt5qmlimport(QtQuick.2) >= 2
qt5qmlimport(QtQuick.2) >= 1
qt5qmlimport(org.kde.plasma.plasmoid.2) >= 0
qt5qmlimport(QtQuick.2) >= 4
qt5qmlimport(org.kde.plasma.extras.2) >= 0
qt5qmlimport(org.kde.kquickcontrolsaddons.2) >= 0
qt5qmlimport(QtQuick.Controls.2) >= 5
qt5qmlimport(org.kde.plasma.components.3) >= 0
qt5qmlimport(org.kde.kirigami.2) >= 5
qt5qmlimport(org.kde.plasma.components.2) >= 0
qt5qmlimport(QtQuick.Controls.2) >= 2
qt5qmlimport(org.kde.kirigami.2) >= 4
qt5qmlimport(QtQuick.Dialogs.1) >= 0
qt5qmlimport(QtQuick.Controls.2) >= 4
qt5qmlimport(QtQml.2) >= 2
qt5qmlimport(Qt.labs.platform.1) >= 1
qt5qmlimport(org.kde.kdeconnect.1) >= 0
qt5qmlimport(QtQuick.Layouts.1) >= 9
sshfs >= 3.7.2
/sbin/ldconfig
Recommends : kpeoplevcard
Suggests : ---
Supplements : ---
>
> LANG=C zypper info --recommends --requires --suggests --supplements kate
Loading repository data...
Reading installed packages...
Information for package kate:
-----------------------------
Repository : Haupt-Repository
Name : kate
Version : 22.12.3-bp155.1.7
Arch : x86_64
Vendor : openSUSE
Installed Size : 4.4 MiB
Installed : Yes
Status : up-to-date
Source package : kate-22.12.3-bp155.1.7.src
Upstream URL : https://kate-editor.org
Summary : Advanced Text Editor
Description :
Kate is an advanced text editor by KDE.
Requires : [47]
libstdc++.so.6()(64bit)
libstdc++.so.6(CXXABI_1.3)(64bit)
libstdc++.so.6(GLIBCXX_3.4)(64bit)
libstdc++.so.6(CXXABI_1.3.9)(64bit)
libstdc++.so.6(GLIBCXX_3.4.21)(64bit)
libstdc++.so.6(GLIBCXX_3.4.9)(64bit)
libc.so.6(GLIBC_2.14)(64bit)
libstdc++.so.6(GLIBCXX_3.4.11)(64bit)
libstdc++.so.6(GLIBCXX_3.4.20)(64bit)
libQt5Core.so.5()(64bit)
libQt5Core.so.5(Qt_5)(64bit)
libQt5Gui.so.5()(64bit)
libQt5Gui.so.5(Qt_5)(64bit)
libQt5Widgets.so.5()(64bit)
libQt5Widgets.so.5(Qt_5)(64bit)
libstdc++.so.6(GLIBCXX_3.4.18)(64bit)
libKF5CoreAddons.so.5()(64bit)
libKF5I18n.so.5()(64bit)
libQt5Core.so.5(Qt_5.15)(64bit)
libQt5Network.so.5()(64bit)
libQt5DBus.so.5()(64bit)
libQt5DBus.so.5(Qt_5)(64bit)
libQt5Network.so.5(Qt_5)(64bit)
libKF5ConfigCore.so.5()(64bit)
libKF5WidgetsAddons.so.5()(64bit)
libQt5Xml.so.5()(64bit)
libQt5Xml.so.5(Qt_5)(64bit)
libKF5ConfigWidgets.so.5()(64bit)
libKF5XmlGui.so.5()(64bit)
libKF5ConfigGui.so.5()(64bit)
libKF5KIOCore.so.5()(64bit)
libKF5KIOWidgets.so.5()(64bit)
libKF5Crash.so.5()(64bit)
libKF5DBusAddons.so.5()(64bit)
libKF5WindowSystem.so.5()(64bit)
libKF5Service.so.5()(64bit)
libKF5IconThemes.so.5()(64bit)
libKF5KIOGui.so.5()(64bit)
libKF5TextWidgets.so.5()(64bit)
libKF5JobWidgets.so.5()(64bit)
libKF5Parts.so.5()(64bit)
libKF5Activities.so.5()(64bit)
libKF5TextEditor.so.5()(64bit)
libKF5SyntaxHighlighting.so.5()(64bit)
libKUserFeedbackCore.so.1()(64bit)
libKUserFeedbackWidgets.so.1()(64bit)
kate-plugins = 22.12.3
Recommends : ---
Suggests : ---
Supplements : ---
>
In other words, I can’t really see where there’s a dependency between KDE Connect and Kate and, I can’t really see any reason why KDE Connect cannot be simply removed if, it’s never going to be needed – despite it’s dependencies to kpeoplevcard, libKF5PulseAudioQt3, libfakekey0 and sshfs (which can all be re-installed if needed) …
This sounds like a distribution issue, I promise that KDE Plasma doesn’t depend on KDE Connect in any way. I couldn’t really figure out what you’re asking specifically, it sounds like you need to file a bug against Fedora Kionite?
Yeah, with an immutable distro such as Kinoite, it’s more challenging to uninstall software that’s bundled with the base OS compared to a distro where everything is read-write.
This is a distro issue though, not an issue with KDE Connect.
BTW, why is kdeconnectd both autostarted and dbus-activated? I guess either should suffice?
And perhaps instead of either way above, it’s better to manage kdeconnectd via a kded plugin, so the user can simply disable it in systemsettings - session - background service.
Having the ability to opt-in to both KDE Connect and CUPS is essential for secure systems. And a normal user-facing way to disable or enable kdeconnect would be very much needed!
yes this is an option. But as said (I think) is is not a good one. On rpm-ostree systems that would mean opt-in = layering the packages, or opt-out = changing the root system. This would make things like an Attestation app checking the root filesystem integrity, impossible.
A normal sane way to disable it through systemd, like CUPS, is needed