{"id":253,"date":"2014-12-02T10:51:46","date_gmt":"2014-12-02T10:51:46","guid":{"rendered":"http:\/\/www.flat-planet.net\/?p=253"},"modified":"2014-12-02T10:51:46","modified_gmt":"2014-12-02T10:51:46","slug":"raspberry-pi-as-a-server","status":"publish","type":"post","link":"https:\/\/flat-planet.net\/?p=253","title":{"rendered":"Raspberry Pi as a server"},"content":{"rendered":"

I’m planning on using a Raspberry Pi as a Webserver at some point, but wanted to lock it down a bit more then the default would allow, so here are a few quick notes on how to do that. I’m assuming that you have network connectivity here and can login via ssh.<\/p>\n

Update the Pi<\/h2>\n
\r\nsudo apt-get update\r\nsudo apt-get upgrade\r\nsudo rpi-update\r\nreboot\r\n<\/pre>\n
Secure SSH Acess<\/h2>\n
For starters, lets create a new account, get the privileges correctly, and then delete the default ‘pi’ account – just a little bit too easy.<\/p>\n
\r\nsudo adduser serverpi\r\n<\/pre>\n
Fill in the information, and set a good password (long, mix of uppercase, lowercase, symbols, etc.)<\/p>\n
Once this user exists, we should add them to all the groups as the pi account:<\/p>\n
\r\n~ $ groups pi\r\npi : pi adm dialout cdrom sudo audio video plugdev games users netdev input spi gpio\r\n\r\nserverpi@my-raspberry-pi ~ $ sudo usermod -a -G sudo serverpi\r\nserverpi@my-raspberry-pi ~ $ sudo usermod -a -G adm serverpi\r\nserverpi@my-raspberry-pi ~ $ sudo usermod -a -G pi serverpi\r\nserverpi@my-raspberry-pi ~ $ sudo usermod -a -G dialout serverpi\r\nserverpi@my-raspberry-pi ~ $ sudo usermod -a -G cdrom serverpi\r\nserverpi@my-raspberry-pi ~ $ sudo usermod -a -G audio serverpi\r\nserverpi@my-raspberry-pi ~ $ sudo usermod -a -G video serverpi\r\nserverpi@my-raspberry-pi ~ $ sudo usermod -a -G plugdev serverpi\r\nserverpi@my-raspberry-pi ~ $ sudo usermod -a -G games serverpi\r\nserverpi@my-raspberry-pi ~ $ sudo usermod -a -G users serverpi\r\nserverpi@my-raspberry-pi ~ $ sudo usermod -a -G netdev serverpi\r\nserverpi@my-raspberry-pi ~ $ sudo usermod -a -G input serverpi\r\nserverpi@my-raspberry-pi ~ $ sudo usermod -a -G spi serverpi\r\nserverpi@my-raspberry-pi ~ $ sudo usermod -a -G gpio serverpi\r\n<\/pre>\n
Ideally, set the server to use PublicKey Authentication, and disable passwords – plenty of guides online to do this (create .ssh directory and add your public key to the authorized_keys file).<\/p>\n
Test the login with the new account.<\/p>\n
Delete the default user ‘pi’<\/h2>\n
\r\nsudo userdel pi\r\nsudo rm -rf \/home\/pi\r\n<\/pre>\n
Improving the Performance<\/h2>\n
Run the configuration utility:<\/p>\n
\r\nsudo raspi-config\r\n<\/pre>\n
    \n
  • Expand the filesystem<\/li>\n
  • Set the locale and timezone<\/li>\n
  • Set overclock to ‘modest’<\/li>\n
  • Use the advanced options to set the hostname to something meaningful, and since we aren’t using a display set the GPU memory to something more modest e.g. 32 or 0<\/li>\n<\/ul>\n
    Finish up and reboot<\/p>\n
    Basic Intrusion Prevention<\/h2>\n
    Something that any linux based box connecting to the internet should install is fail2ban. This is a python based framework that monitors log files and will block IP Addresses that are continually making login attempts. The ‘banned’ IP is locked out for a configurable length of time, and then unblocked.<\/p>\n
    Standard package can handle sshd, Apache, etc. which suits my purposes nicely.<\/p>\n
    \r\nsudo apt-get install fail2ban\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"
    I’m planning on using a Raspberry Pi as a Webserver at some point, but wanted to lock it down a bit more then the default would allow, so here are a few quick notes on how to do that. I’m assuming that you have network connectivity here and can login via ssh. Update the Pi […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[38,63],"tags":[111,42,64,110,109],"series":[],"class_list":["post-253","post","type-post","status-publish","format-standard","hentry","category-linux","category-raspberry-pi","tag-basic-security","tag-linux-2","tag-raspberry-pi-2","tag-server","tag-setup"],"_links":{"self":[{"href":"https:\/\/flat-planet.net\/index.php?rest_route=\/wp\/v2\/posts\/253","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/flat-planet.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/flat-planet.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/flat-planet.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/flat-planet.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=253"}],"version-history":[{"count":2,"href":"https:\/\/flat-planet.net\/index.php?rest_route=\/wp\/v2\/posts\/253\/revisions"}],"predecessor-version":[{"id":255,"href":"https:\/\/flat-planet.net\/index.php?rest_route=\/wp\/v2\/posts\/253\/revisions\/255"}],"wp:attachment":[{"href":"https:\/\/flat-planet.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=253"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/flat-planet.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=253"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/flat-planet.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=253"},{"taxonomy":"series","embeddable":true,"href":"https:\/\/flat-planet.net\/index.php?rest_route=%2Fwp%2Fv2%2Fseries&post=253"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}