hello, everyone. interesting thread. similar to user479 in post #44, i
wanted to add some more data for completeness.

i noticed the accumulating files last year but was not curious enough
to search for more information. just added rm's to my weekly clean-up
script.

based on another post, i commented-out IDTYPE=RANDOM, which prevents
the file accumulation and reverted the changes to my clean-up script.

based on this thread it appears that IDTYPE=RANDOM is a "good thing"
so those deletes will be getting added back.

my set-up is daedalus+KDE so sddm and pulseaudio are also installed.

on my system, the machine-id is defined in /var/lib/dbus/machine-id.
there is no /etc/machine-id file.

in addition to the ~/.dbus/session-bus and /root/.dbus/session-bus
directories mentioned in post #1, with KDE there is also the
/var/lib/sddm/.dbus/session-bus directory to clean-up.

and pulseaudio pollutes ~/.config/pulse with 6 files/directories, so
need to clean-up these as well:

   <machine-id>-card-database.tdb
   <machine-id>-default-sink
   <machine-id>-default-source
   <machine-id>-device-volumes.tdb
   <machine-id>-runtime
   <machine-id>-stream-volumes.tdb

no idea how this will change with excalibur.

thank you @steve_v for your very informative reply.

'apt show eudev' does mention the gentoo connection and the author, jaret jay cantu,
and says eudev is a fork of systemd-udev originally from 2015. the last github release
is 3.2.14 from october 2023.

never having checked, i just assumed eudev did all kinds of things to get /dev configured.
that it is mostly (exclusively?) used to support hot-plug of devices is surprising to me.
but then my knowledge of linux/debian is limited.

i wonder, does devuan source eudev unmodified from the github repo? or is it forked
anew?

corsair has sent me a replacement USB drive - via fedex from taiwan no less!

they immediately told me to do an RMA and were eager to close the ticket.
quite the experience.

i asked the two reps responding to the ticket what was wrong with the drive
and one ignored me, the other said:

   "Probably a hardware failure."

the drive works perfectly fine, except for the not-bootable problem, so i am
skeptical the hardware is failing.

my guess is that corsair had a batch (or two or three) that had bad firmware
where the isbootable-bit in the code has not been set. oof!

boy do i feel dumb. i found out why netinstall would not boot.

the USB drive i use is really fast, a corsiar voyager GTX 128GB.
but, for reasons, this USB drive is not bootable. wtf?

i copied the netinstall iso to a different USB drive (sandisk) and
was able to install without issue.

i will mark this as solved (though it isn't) as the problem i am having
lies elsewhere. the devuan netinstall iso works just fine.

thanks for the advise everyone

i was not clear enough. i loop-mounted the iso file not the USB drive.

i checked the USB drive as well by mounting it on a running system.

the ventoy trick did not work. ventoy was able to start the installer and i got to the
inital screen. after i hit the enter-key a bunch of boot-time ouput scrolled past ending
in an error about not being able to mount /cdrom. an emergency shell was created
but the keyboard was unresponsive, so i could not so anything in the emergency shell.

my next idea is to disassemble the machine, extract the nvme drive, move it to an
external enclousure, plug it into my old kabylake machine, which has CSM mode,
and install there, then move the nvme drive back to the new machine and reassemble it.

the hardening-runtime package is out-of-date and should be uninstalled.

in particular, the boot option kaslr no longer exists as kaslr is the
default. however, there is a 'nokaslr' kernel parameter:

nokaslr         [KNL,EARLY]
                When CONFIG_RANDOMIZE_BASE is set, this disables
                kernel and module base offset ASLR (Address Space
                Layout Randomization).

i have 6.10 kernel from backports and its boot options can be found here:
   https://www.kernel.org/doc/html/v6.10/a … tions.html

the 6.10 kernel params can be found here:
   https://www.kernel.org/doc/html/v6.10/a … eters.html

just change the kernel version in the above URLs to what your kernel is
and take a look.

a good, more up-to-date, hardening guide can be found here and here:
   https://wiki.archlinux.org/title/Hardening_Guides
   https://gist.github.com/dante-robinson/ … 87633ff8ca

additionally, page_poison is no longer recommended and should be replaced
with 'init_on_alloc=1 init_on_free=1' and, related to this, change to
slub_debug=ZF instead of slub_debug=FPZ

for reference, my personalised 'hardened' grub command line is:

   ipv6.disable=1 ia32_emulation=0 page_alloc.shuffle=1   \
   pti=on init_on_free=1 slab_nomerge slub_debug=ZF vsyscall=none"

on a practical note, hardening devuan/debian is really hard :-) so not
really worth it. the biggest weakness is the browser, not the kernel.
try to harden firefox (apparmor, firejail, VM) first.

if you are really motivated then checkout the firefox hardening guides
such as arkenfox user.js. this involves a lot of work and is for the paranoid.

if you are really interested in hardening linux then try to make the
system read-only. that's a nice, long-term project. see alpine linux.

thanks for the help/advise everyone! i got it sorted now. i only need a NTP client as there is
an NTP server on my lan. chrony installed without issue. added "-4" flag to /etc/default/chrony
and the server ip to /etc/chrony/chrony.conf and rebooted. 'chronyc tracking' shows things
as working as desired.

the first time chrony started-up and did a sync it adjusted the system clock by 30 seconds!
my mobo realtime clock must drift a lot.

so i found something. not perfect, but better than nothing.

it turns out ModemManager is started by (everyone's favorite) dbus.

the directory /usr/share/dbus-1/system-services contains systemd .service files.
at init-time dbus scans this directory and starts all the listed services.

i did not find documentation about the function of this directory, so it does
appear to just be baked-in to debian. this setup must be documented somewhere
but i did not find out where.

to disable ModemManager just rename the appropriate file so that it get ignored.

so, rename /usr/share/dbus-1/system-services/org.freedesktop.ModemManager1.service
to /usr/share/dbus-1/system-services/org.freedesktop.ModemManager1.service.disabled

the only catch is that if dbus/ModemManager every get updated this change probably
gets stomped-on and needs to be redone. but, since an update is very unlikely until
devuan excalibur rolls around, not too bad.