I’m planning on using a Raspberry Pi as a Webserver at some point, but wanted to lock it down a bit more then the default would allow, so here are a few quick notes on how to do that. I’m assuming that you have network connectivity here and can login via ssh.
Update the Pi
sudo apt-get update sudo apt-get upgrade sudo rpi-update reboot
Secure SSH Acess
For starters, lets create a new account, get the privileges correctly, and then delete the default ‘pi’ account – just a little bit too easy.
sudo adduser serverpi
Fill in the information, and set a good password (long, mix of uppercase, lowercase, symbols, etc.)
Once this user exists, we should add them to all the groups as the pi account:
~ $ groups pi pi : pi adm dialout cdrom sudo audio video plugdev games users netdev input spi gpio serverpi@my-raspberry-pi ~ $ sudo usermod -a -G sudo serverpi serverpi@my-raspberry-pi ~ $ sudo usermod -a -G adm serverpi serverpi@my-raspberry-pi ~ $ sudo usermod -a -G pi serverpi serverpi@my-raspberry-pi ~ $ sudo usermod -a -G dialout serverpi serverpi@my-raspberry-pi ~ $ sudo usermod -a -G cdrom serverpi serverpi@my-raspberry-pi ~ $ sudo usermod -a -G audio serverpi serverpi@my-raspberry-pi ~ $ sudo usermod -a -G video serverpi serverpi@my-raspberry-pi ~ $ sudo usermod -a -G plugdev serverpi serverpi@my-raspberry-pi ~ $ sudo usermod -a -G games serverpi serverpi@my-raspberry-pi ~ $ sudo usermod -a -G users serverpi serverpi@my-raspberry-pi ~ $ sudo usermod -a -G netdev serverpi serverpi@my-raspberry-pi ~ $ sudo usermod -a -G input serverpi serverpi@my-raspberry-pi ~ $ sudo usermod -a -G spi serverpi serverpi@my-raspberry-pi ~ $ sudo usermod -a -G gpio serverpi
Ideally, set the server to use PublicKey Authentication, and disable passwords – plenty of guides online to do this (create .ssh directory and add your public key to the authorized_keys file).
Test the login with the new account.
Delete the default user ‘pi’
sudo userdel pi sudo rm -rf /home/pi
Improving the Performance
Run the configuration utility:
sudo raspi-config
- Expand the filesystem
- Set the locale and timezone
- Set overclock to ‘modest’
- Use the advanced options to set the hostname to something meaningful, and since we aren’t using a display set the GPU memory to something more modest e.g. 32 or 0
Finish up and reboot
Basic Intrusion Prevention
Something that any linux based box connecting to the internet should install is fail2ban. This is a python based framework that monitors log files and will block IP Addresses that are continually making login attempts. The ‘banned’ IP is locked out for a configurable length of time, and then unblocked.
Standard package can handle sshd, Apache, etc. which suits my purposes nicely.
sudo apt-get install fail2ban
