Skip to main content

Raspberry Pi Security Tutorial

Introduction​

Welcome to our Raspberry Pi security tutorial! Today, we'll walk you through the essential steps to secure your Raspberry Pi devices. Raspberry Pis are fantastic for various projects, but their default security settings can leave them vulnerable. We'll show you how to tighten security to keep your network safe.

Setting the Scene​

Imagine finding a Raspberry Pi gadget in your office that’s connected to your network. It’s collecting data and seems useful, but you realize it’s using default credentials and could be a security risk. Let’s go through the steps to make sure your Raspberry Pi is secure.

Steps to Secure Your Raspberry Pi​

1. Initial Configuration​

When you first set up your Raspberry Pi, the default operating system is Raspbian. After flashing Raspbian onto an SD card and booting up, the first step is to run the raspi-config script.

sudo raspi-config
  • Change the Default Password: The default username is pi and the password is raspberry. Change it immediately to something secure.
  • Enable SSH: Navigate to Interfacing Options > SSH and enable it.
  • Set Localization: Ensure your keyboard layout and time zone are set correctly to avoid issues.

2. Create a New User​

Using the default pi user is not recommended. Create a new user and add it to the sudoers group.

sudo adduser newuser
sudo usermod -aG sudo newuser

Then, lock the pi user account:

sudo passwd -l pi

3. Keep Your System Updated​

Ensure your system is always updated to protect against vulnerabilities.

sudo apt update && sudo apt upgrade -y

For automatic updates, install and configure unattended-upgrades:

sudo apt install unattended-upgrades
sudo dpkg-reconfigure unattended-upgrades

Edit /etc/apt/apt.conf.d/50unattended-upgrades to include Raspbian updates.

4. Install and Configure a Firewall​

Use UFW (Uncomplicated Firewall) to manage firewall rules.

sudo apt install ufw
sudo ufw allow ssh
sudo ufw enable

Check the status:

sudo ufw status

5. Secure SSH​

Edit the SSH configuration file to restrict access.

sudo nano /etc/ssh/sshd_config
  • Disable Root Login: Set PermitRootLogin to no.
  • Allow Specific Users: Add AllowUsers newuser.

Restart the SSH service:

sudo systemctl restart ssh

6. Install Fail2Ban​

Install Fail2Ban to protect against brute force attacks.

sudo apt install fail2ban

Configure Fail2Ban for SSH by editing /etc/fail2ban/jail.local:

[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 5

[sshd]
enabled = true

Start and enable Fail2Ban:

sudo systemctl start fail2ban
sudo systemctl enable fail2ban

7. Disable Unnecessary Services​

List active services:

sudo systemctl list-units --type=service --state=active

Disable any unnecessary services:

sudo systemctl disable service_name

8. Additional Security Measures​

Certificate-Based Authentication for SSH:

Using certificate-based authentication adds an extra layer of security. To set this up:

1. Generate SSH Keys:​

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

2. Copy the Public Key to the Raspberry Pi:​

ssh-copy-id newuser@raspberrypi_ip_address

3. Disable Password Authentication: Edit /etc/ssh/sshd_config and set PasswordAuthentication to no.​

4. Restart SSH:​

sudo systemctl restart ssh

Secure Web Services with Trusted Certificates:​

If you are running web services on your Raspberry Pi, securing them with trusted SSL/TLS certificates is essential.

  1. Install Certbot:

    sudo apt install certbot

  2. Obtain a Certificate:

    sudo certbot certonly --standalone -d your_domain

  3. Configure Your Web Server: Update your web server configuration to use the obtained certificates. For example, if you're using Nginx:

    server {
        listen 443 ssl;
        server_name your_domain;

        ssl_certificate /etc/letsencrypt/live/your_domain/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/your_domain/privkey.pem;
        ...
    }

  4. Enable Auto-Renewal:

    sudo crontab -e
    # Add the following line to renew the certificates automatically
    0 0 * * * /usr/bin/certbot renew --quiet

Conclusion​

By following these steps, you'll significantly improve the security of your Raspberry Pi devices. Regular updates, user management, firewalls, and brute force protection are essential components of a secure system. Adding certificate-based authentication and securing web services with trusted certificates further enhances security. Stay safe and enjoy your projects with the peace of mind that your Raspberry Pi is secure!

Subscribe and Stay Updated​

Make sure to subscribe to our channel for more tutorials and IT tips. Happy Pi Day, and stay secure!