Skip to content

Latest commit

 

History

History
188 lines (114 loc) · 7.3 KB

01-Setting-Up-The-Server.md

File metadata and controls

188 lines (114 loc) · 7.3 KB

Set up the RPI4 server

Download Ubuntu Server image or Raspbian for Raspberry Pi. It is recommended to get the LTS version.

Raspbian is more lightweight and more suitable for Raspberry.

Burn the image on the SD card using Balena Etcher (or Rufus).

Insert the SD card to the Raspberry and connect your Raspberry to a power supply so it will boot. You should connect your Raspberry to some kind of display using the HDMI ports for the first configurations (at least until SSH is ready).

Once booted, log in using the default credentials for your server:

  • User: ubuntu Password: ubuntu if we are on Ubuntu Server.
  • User: pi Password: raspberry if we are on Raspbian.

Once logged in, change the password. It should automatically ask you to change it. If not, use passwd to change it.

Depending on what OS you chose, you can jump to:

Raspbian config

The sudo raspi-config command comes very handy for basic configuration. Use it to enable SSH server and change keyboard layout before proceding.

Now we will configure the internet connections for the RPI. We will be setting up the Wi-Fi connection with DHCP4 (will assign an IP dynamically; this is for the first updates and so) and then we will be configuring the Ethernet port with a static IP for when we set up the RPI as a server.

To setup the WiFi connection use sudo raspi-config and search through the menus for the WiFi configuration. There, enter the SSID (network name) and Password to connect to your network. Once done, reboot the RPI.

Now update all packages with: sudo apt-get update && sudo apt-get upgrade

Now let's configure the static IP for the eth0 port.

For this we will need to edit the /etc/dhcpcd.conf file:

  • sudo nano /etc/dhcpcd.conf

Add the following lines at the end of the file:

interface eth0
static ip_address=192.168.1.222/24    
static routers=192.168.1.1
static domain_name_servers=192.168.1.1 9.9.9.9

This way we are assigning the static ip 192.168.1.222 to the raspberry pi eth0 port. Also we are using 9.9.9.9 as the DNS provider (Quad9). You can change this to suit your needs.

Now shut down the RPI with shutdown now and connect the Ethernet cable. Once booted, try to SSH to the RPI-4 with the assigned IP:

ssh username@ip

Once you have ssh to the RPI, you can proceed to secure the SSH configuration. To do so we will deactivate the password and root login for SSH for security.

To generate a private+public key pair on * NIX systems, launch this command on the local machine (your workstation, not the server):

ssh-keygen -t ed25519 -C "comment"

You need to specify the path for the keys when you choose the keys filename. You can use the default folder destination for the keys. Then you will need to copy the generated keys to the remote machine (RPI):

ssh-copy-id -i $HOME/.ssh/keyname.pub username@ip

Now you can try to ssh again to the server and see that you are no longer prompted for a password:

ssh username@server

NOTE: make sure to back up your ssh keys ($HOME/.ssh/ directory)

Now we will edit the SSH config to make it more secure:

sudo nano /etc/ssh/sshd_config

You will need to find the following variables and set the values to the ones you can see here. This will disable the root login and the password prompt. You will only be able to login to your server via SSH with a pair of valid keys.

ChallengeResponseAuthentication no
PasswordAuthentication no
UsePAM no
PermitRootLogin no

Once done, restart the SSH service:

sudo systemctl reload ssh

And finally, install a basic firewall protection:

sudo apt install fail2ban

Fail2ban will ban the IPs that try to intrude your system, it will ban them after 5 tries with an exponentially increasing time ban.

Activate Fail2Ban:

sudo systemctl start fail2ban && sudo systemctl enable fail2ban

If you want to check the jailed IPs use:

fail2ban-client status

It is recommended to further configure it with this guide if you wish to learn more about fail2ban.

You are done with setting up your server. Now you can proceed to the second step of the guide.

Ubuntu config

Now we will configure the internet connections for the RPI. We will be setting up the Wi-Fi connection with DHCP4 (will assign an IP dynamically; this is for the first updates and so) and then we will be configuring the Ethernet port with a static IP for when we set up the RPI-4 as a server.

To do so we will need to edit the file 50-cloud-init.yaml

  • sudo vim /etc/netplan/50-cloud-init.yaml

Once we are editing it we will paste this configuration (replacing whatever is in the file):

network:
    version: 2
    ethernets:
        eth0:
          dhcp4: no
          addresses:
            - 192.168.1.221/24
          gateway4: 192.168.1.1
          nameservers:
            addresses: [9.9.9.9, 1.1.1.1]
    wifis:
        wlan0:
            optional: true
            access-points:
                "<SSID>":
                     password: "<YourW1f1PassW0rD"
            dhcp4: true

Now we will save using ESC and then the command :wq to exit and save Vim. Make sure to change anything that is between <> to suit your network. Also check that the gateway4 (router) is the same for your network. And assign the IP of your choice: with this config the RPI-4 IP will be 192.168.1.221.

Once done, apply this config with sudo netplan apply.

Now we will configure SSH so we can control the RPI from another computer; and we will also deactivate the password and root login for SSH for security.

To generate a private+public key pair on *NIX systems, launch this command on the local machine (not RPI):

ssh-keygen -t ed25519 -C "raspberrypi"

You can use the default folder destination for the keys. Then you will need to copy the generated keys to the remote machine (RPI):

ssh-copy-id -i $HOME/.ssh/id_rsa.pub ubuntu@192.168.1.221

Now you are ready to connect via SSH to the RPI:

ssh ubuntu@192.168.1.221

Now we will edit the SSH config to make it more secure:

sudo vim /etc/ssh/sshd_config

You will need to find the following variables and set the values to the ones you can see here:

ChallengeResponseAuthentication no
PasswordAuthentication no
UsePAM no
PermitRootLogin no

Once done, restart the ssh service:

sudo systemctl reload ssh

And finally, install a basic firewall protection:

sudo apt install fail2ban

Fail2ban will ban the IPs that try to intrude your system, it will ban them after 5 tries with an exponentially increasing time ban.

Activate Fail2Ban:

sudo systemctl start fail2ban && sudo systemctl enable fail2ban

If you want to check the jailed IPs use:

fail2ban-client status

It is recommended to further configure it (with this guide)[https://linuxhandbook.com/fail2ban-basic/] if you wish to learn more about fail2ban.

You are done with setting up your server. Now you can proceed to the second step of the guide.