Lab: setting up a Raspberry Pi securely

Aim and what you need

The aim is a Pi you can safely leave running at home as an MQTT (Message Queuing Telemetry Transport) broker, dashboard or monitoring box. Many IoT incidents start with a device on default settings, so you will fix that from the start.

• A Raspberry Pi (a Pi 4 or 5 is comfortable), a good power supply and a microSD card or SSD.
• Another computer with Raspberry Pi Imager installed.
• Your home or lab network, ideally on its own IoT network (see the IoT VLAN lab). This lab uses 192.168.10.0/24 as the example LAN.

Steps

1. In Raspberry Pi Imager, choose Raspberry Pi OS Lite (64-bit). In the OS customisation settings, set a hostname, a unique username and strong password, your Wi-Fi country and locale, and enable SSH with public-key authentication only, pasting your public key.
2. Boot the Pi, find its address on your router and connect with SSH.
3. Update everything and reboot.
4. Confirm key login works, then add a small SSH hardening file.
5. Install the firewall, allow SSH only from your LAN and enable it.
6. Install and enable unattended security upgrades.
7. Remove anything you do not need and check which services listen on the network.

# on your computer, if you do not have a key yet
ssh-keygen -t ed25519 -C "pi-lab"
ssh <username>@<pi-hostname>.local

# on the Pi
sudo apt update && sudo apt full-upgrade -y
sudo reboot

sudo nano /etc/ssh/sshd_config.d/10-hardening.conf
#   PasswordAuthentication no
#   PermitRootLogin no
#   KbdInteractiveAuthentication no
sudo sshd -t
sudo systemctl restart ssh

sudo apt install -y ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from 192.168.10.0/24 to any port 22 proto tcp
sudo ufw enable

sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

sudo ss -tulpn
systemctl list-units --type=service --state=running

Warning: keep your current SSH session open while you change SSH and firewall settings, and test a second login before closing it. That way a typing mistake cannot lock you out.

How to verify and troubleshoot

From another machine, an SSH attempt with a password (for example ssh -o PubkeyAuthentication=no <username>@<pi-hostname>.local) should be refused. sudo sshd -T | grep -i passwordauthentication should print no. sudo ufw status verbose should show default deny incoming and one allow rule. ss -tulpn should list only the services you expect.

• Cannot find the Pi: check your router's DHCP (Dynamic Host Configuration Protocol) client list; .local names need mDNS (multicast DNS) on your computer.
• Locked out: connect a keyboard and screen, or mount the card on another computer and fix the SSH file.
• Permission denied (publickey): the wrong key is being offered; use ssh -i with the right private key.

Clean-up and keeping it safe

This build is meant to stay. Keep it safe by never port-forwarding SSH from the internet (use a VPN instead), backing up the card image after big changes, and checking updates monthly with sudo apt update && apt list --upgradable. When you retire the Pi, remove its public key from your notes, delete any stored Wi-Fi and cloud credentials and wipe the card before reusing or giving it away.