Bird
Raised Fist0
Raspberry Piprogramming~10 mins

Securing Raspberry Pi (SSH keys, firewall)

Choose your learning style10 modes available
LearnWhyDeepVisualTryChallengeProjectRecallTime
Introduction

Securing your Raspberry Pi helps keep it safe from hackers. Using SSH keys and a firewall protects your device when you connect to it remotely.

When you want to connect to your Raspberry Pi from another computer safely.
When you want to stop strangers from accessing your Raspberry Pi over the internet.
When you want to avoid typing your password every time you log in remotely.
When you want to control which devices can talk to your Raspberry Pi.
When you want to keep your Raspberry Pi safe while running projects connected to a network.
Syntax
Raspberry Pi
1. Generate SSH keys on your computer:
   ssh-keygen -t rsa -b 4096

2. Copy your public key to Raspberry Pi:
   ssh-copy-id pi@raspberrypi.local

3. Enable firewall (ufw) on Raspberry Pi:
   sudo apt install ufw
   sudo ufw allow ssh
   sudo ufw enable

4. Check firewall status:
   sudo ufw status

SSH keys replace passwords with a pair of secret and public keys for safer login.

Firewall (ufw) controls which connections are allowed to your Raspberry Pi.

Examples
This command creates a strong pair of SSH keys on your computer.
Raspberry Pi
ssh-keygen -t rsa -b 4096
This copies your public key to the Raspberry Pi so you can log in without a password.
Raspberry Pi
ssh-copy-id pi@raspberrypi.local
This allows SSH connections through the firewall.
Raspberry Pi
sudo ufw allow ssh
This turns on the firewall to protect your Raspberry Pi.
Raspberry Pi
sudo ufw enable
Sample Program

This script shows the main steps to secure your Raspberry Pi: create SSH keys, copy them, connect using keys, and set up a firewall.

Raspberry Pi
#!/bin/bash

# Step 1: Generate SSH key pair (run on your computer)
ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rpi_key -N ""

# Step 2: Copy public key to Raspberry Pi
ssh-copy-id -i ~/.ssh/id_rpi_key.pub pi@raspberrypi.local

# Step 3: Connect to Raspberry Pi using the new key and set up firewall
ssh -i ~/.ssh/id_rpi_key pi@raspberrypi.local 'sudo apt update && sudo apt install -y ufw && sudo ufw allow ssh && sudo ufw enable && sudo ufw status'
OutputSuccess
Important Notes

Always keep your private SSH key safe and never share it.

Use strong passphrases for SSH keys if you want extra security.

Check firewall rules regularly to avoid blocking needed connections.

Summary

Use SSH keys to log in without passwords and improve security.

Set up a firewall to control network access to your Raspberry Pi.

These steps help protect your Raspberry Pi from unauthorized access.

Practice

(1/5)
1. What is the main benefit of using SSH keys instead of passwords to access your Raspberry Pi?
easy
A. It improves security by avoiding password guessing attacks.
B. It makes the Raspberry Pi run faster.
C. It allows multiple users to share the same password.
D. It disables the firewall automatically.

Solution

  1. Step 1: Understand SSH key authentication

    SSH keys use a pair of cryptographic keys to authenticate users without sending passwords over the network.

  2. Step 2: Compare with password authentication

    Password authentication can be vulnerable to guessing or brute force attacks, while SSH keys are much harder to crack.

  3. Final Answer:

    It improves security by avoiding password guessing attacks. -> Option A

  4. Quick Check:

    SSH keys = better security [OK]
Hint: SSH keys stop password guessing attacks fast [OK]
Common Mistakes:
  • Thinking SSH keys make the device faster
  • Believing SSH keys share passwords
  • Assuming SSH keys disable firewall
2. Which command correctly generates an SSH key pair on your Raspberry Pi?
easy
A. ssh-keygen --firewall
B. ssh-keygen -p rsa
C. ssh-keygen -t rsa
D. firewall-cmd --generate-key

Solution

  1. Step 1: Identify the SSH key generation command

    The standard command to create SSH keys is ssh-keygen with the -t option to specify the type, e.g., rsa.

  2. Step 2: Check options for correctness

    -p changes the passphrase, --firewall and firewall-cmd are unrelated to SSH keys.

  3. Final Answer:

    ssh-keygen -t rsa -> Option C

  4. Quick Check:

    ssh-keygen -t rsa = generate SSH keys [OK]
Hint: Use ssh-keygen with -t to specify key type [OK]
Common Mistakes:
  • Using -p instead of -t for key generation
  • Confusing firewall commands with SSH key commands
  • Trying to generate keys with firewall tools
3. Given the following commands run on a Raspberry Pi, what will be the output of sudo ufw status? 
sudo ufw enable
sudo ufw allow ssh
sudo ufw deny 80
medium
A. Error: ufw command not found
B. Status: inactive
C. Status: active No rules defined
D. Status: active To Action From -- ------ ---- 22/tcp ALLOW Anywhere 80 DENY Anywhere

Solution

  1. Step 1: Analyze the firewall commands

    sudo ufw enable activates the firewall. sudo ufw allow ssh opens port 22 (SSH). sudo ufw deny 80 blocks HTTP port 80.

  2. Step 2: Understand the status output

    The status shows active firewall with rules allowing SSH (port 22) and denying port 80.

  3. Final Answer:

    Status: active To Action From -- ------ ---- 22/tcp ALLOW Anywhere 80 DENY Anywhere -> Option D

  4. Quick Check:

    Firewall enabled with SSH allow and port 80 deny = Status: active To Action From -- ------ ---- 22/tcp ALLOW Anywhere 80 DENY Anywhere [OK]
Hint: Enable ufw then add rules to see them in status [OK]
Common Mistakes:
  • Assuming firewall is inactive after enabling
  • Expecting no rules after adding allow/deny
  • Confusing port numbers with service names
4. You tried to add your SSH public key to ~/.ssh/authorized_keys but still get password prompts. What is the most likely cause?
medium
A. The authorized_keys file has incorrect permissions.
B. The Raspberry Pi firewall is disabled.
C. You forgot to restart the SSH service.
D. You used the wrong SSH key type.

Solution

  1. Step 1: Check SSH key authentication requirements

    SSH requires strict permissions on ~/.ssh and authorized_keys files to allow key login.

  2. Step 2: Identify common permission issues

    If permissions are too open, SSH ignores the keys and falls back to password login.

  3. Final Answer:

    The authorized_keys file has incorrect permissions. -> Option A

  4. Quick Check:

    Wrong permissions block SSH key login [OK]
Hint: Check .ssh and authorized_keys permissions first [OK]
Common Mistakes:
  • Thinking firewall affects SSH key login
  • Restarting SSH service unnecessarily
  • Assuming wrong key type without checking permissions
5. You want to secure your Raspberry Pi by allowing SSH access only from a specific IP address 192.168.1.100 and blocking all other SSH attempts. Which ufw commands achieve this?
hard
A. sudo ufw allow from any to any port 22 sudo ufw deny from 192.168.1.100
B. sudo ufw allow from 192.168.1.100 to any port 22 sudo ufw deny 22
C. sudo ufw deny ssh sudo ufw allow 22
D. sudo ufw allow ssh sudo ufw deny from 192.168.1.100 to any port 22

Solution

  1. Step 1: Allow SSH only from the specific IP

    Use sudo ufw allow from 192.168.1.100 to any port 22 to permit SSH from that IP.

  2. Step 2: Deny all other SSH connections

    Use sudo ufw deny 22 to block SSH from all other IPs.

  3. Final Answer:

    sudo ufw allow from 192.168.1.100 to any port 22 sudo ufw deny 22 -> Option B

  4. Quick Check:

    Allow specific IP then deny all others = sudo ufw allow from 192.168.1.100 to any port 22 sudo ufw deny 22 [OK]
Hint: Allow specific IP first, then deny all others [OK]
Common Mistakes:
  • Allowing SSH globally before denying specific IP
  • Denying the allowed IP instead of others
  • Using wrong port numbers or commands
Recommended

Ready to prove it?

Pass the test and this pattern moves unknown strong while earning +1 Grip toward your certificate.

10 questions~5 mineasy hard