Repository navigation
Base Configuration
Follow instructions at https://www.raspberrypi.org/documentation/installation/installing-images/linux.md
connect to your router admin to identify the ip address assigned by dhcp server
ssh user "pi" password "raspberry"
using sudo rasp-config do the following :
- Expand partition in order to use whole space of the micro SD card
- Change pi user's password
- Disable
boot to dektop - setup local :
en,fr,ja - set timezone
- set keyboard
- set hostname (use of your choice):
severin-pi - set memory split (we don't need GPU) :
GPU = 16 - enable ssh (it's probably already enabled if you ssh to your pi ^^)
- update raspi-config tool
then finally reboot the system
we need a static ip address to configure our router NAT rules if you want to use it as a server. Follow instructions : https://wiki.debian.org/NetworkConfiguration
edit the file (nano, emacs etc.) /etc/network/interfaces
auto lo
iface lo inet loopback
iface eth0 inet static
address 192.168.0.5
netmask 255.255.255.0
network 192.168.0.0
broadcast 192.168.0.255
gateway 192.168.0.1
allow-hotplug wlan0
iface wlan0 inet manual
wpa-roam /etc/wpa_supplicant/wpa_supplicant.conf
iface default inet dhcp
check pi user's group
groups
add user severin with same pi's groups
sudo useradd -m -G adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,gpio,i2c,spi severin
if you plan to configure nginx with www-data user I would recommend to add your user to www-data group:
sudo usermod -aG www-data severin
change password
sudo passwd severin
login with your user
nano .bash_aliases
# Severin's custom aliases
alias ll='ls -Al'
alias la='ls -A'
alias l='ls -CF'
# temperature
alias temp='sudo /opt/vc/bin/vcgencmd measure_temp'
# just in case
alias rm='rm -i' sudo deluser --remove-all-files pi
Sudo raspi-config
Service ssh start/stop/restart/status
nano /etc/ssh/sshd_config
| Key | Value | Comment |
|---|---|---|
| Port | 1707 | not the default listening port 22 which would be permanently targeted |
| LoginGraceTime | 30 | less than 30 sec to login is a best practice |
| PermitRootLogin | no | Disable Root Login |
| AllowUsers | severin | Only Allow specific user |
| PasswordAuthentication | no | Disable Password Login (Only certificate) |
| X11Forwarding | no | enable yes if you need to forward x11 traffic (unlikely but who knows...) |
| AllowTcpForwarding | yes | enable yes if you want to enable SSH tunneling |
Refer to this documentation https://www.raspberrypi.org/documentation/remote-access/ssh/passwordless.md
write public key in your home folder under .ssh/authorized_keys
sudo apt-get update
sudo apt-get dist-upgrade
sudo visudo
pi ALL=(ALL) PASSWD: ALL
severin ALL=(ALL) PASSWD: ALL
sudo apt-get install emacs
if you are interested who is trying to connect to your system :
nano /var/log/auth.log
You might want to use SSH tunneling to use your raspberry pi as a kind of VPN. there are plenty of documentation how-to available on the Internet, some good ones : https://chamibuddhika.wordpress.com/2012/03/21/ssh-tunnelling-explained/ https://help.ubuntu.com/community/SSH/OpenSSH/PortForwarding
you'll have to enable the following settings in /etc/ssh/sshd_config. Unless it is set to no, it is enabled by default.
AllowTcpForwarding yes
Fail2Ban is an application that prevents dictionary attacks on your server. When Fail2Ban detects multiple failed login attempts from the same IP address, it creates temporary firewall rules that block traffic from the attacker's IP address. Attempted logins can be monitored on a variety of protocols, including SSH, HTTP, and SMTP. By default, Fail2Ban monitors SSH only.
Install Fail2Ban by entering the following command:
sudo apt-get install fail2ban
Fail2Ban is now installed and running on your Pi. It will monitor your log files for failed login attempts. After an IP address has exceeded the maximum number of authentication attempts, it will be blocked at the network level and the event will be logged in /var/log/fail2ban.log