Securing Raspberry Pi (SSH keys, firewall) - Deep Dive

Overview - Securing Raspberry Pi (SSH keys, firewall)

What is it?

Securing a Raspberry Pi means protecting it from unauthorized access and attacks. Two common ways to do this are using SSH keys for safe remote login and setting up a firewall to control network traffic. SSH keys replace passwords with a pair of secret codes, making it harder for strangers to break in. A firewall acts like a gatekeeper, deciding which connections are allowed or blocked.

Why it matters

Without proper security, anyone on the internet or local network could take control of your Raspberry Pi, steal data, or use it for harmful activities. This can lead to privacy loss, device damage, or even your Pi being part of cyberattacks. Using SSH keys and a firewall helps keep your device safe and trustworthy, giving you peace of mind when accessing it remotely.

Where it fits

Before learning this, you should know basic Raspberry Pi setup and how to use the command line. After securing your Pi, you can explore advanced network security, VPNs, or automated security monitoring to protect your device even more.

Mental Model

Core Idea

Securing a Raspberry Pi means replacing weak passwords with strong digital keys and controlling who can talk to it through a network gatekeeper.

Think of it like...

Using SSH keys and a firewall is like having a special lock and a security guard at your front door: the lock only opens with your unique key, and the guard checks who is allowed inside.

┌─────────────────────────────┐
│        Raspberry Pi          │
│                             │
│  ┌───────────────┐          │
│  │ SSH Server    │◄───────┐ │
│  └───────────────┘        │ │
│           ▲                │ │
│           │ SSH Keys       │ │
│           │ (Digital Keys) │ │
│  ┌────────┴────────┐       │ │
│  │   Firewall      │◄──────┘ │
│  │ (Network Gate)  │         │
│  └─────────────────┘         │
└─────────────────────────────┘

Build-Up - 7 Steps

1

Foundation

Understanding SSH and Password Risks

Concept: Learn what SSH is and why passwords can be risky for remote access.

SSH (Secure Shell) is a way to connect to your Raspberry Pi from another computer safely. Normally, you log in with a username and password. But passwords can be guessed or stolen, especially if they are simple or reused. This makes your Pi vulnerable to hackers.

Result

You understand that using only passwords for SSH is risky and can lead to unauthorized access.

Knowing the weakness of passwords motivates the need for stronger, safer login methods.

2

Foundation

Basics of Firewalls on Raspberry Pi

Concept: Learn what a firewall does and why it helps protect your Pi.

A firewall is software that controls network traffic to and from your Raspberry Pi. It can block unwanted connections and allow trusted ones. On Raspberry Pi, tools like 'ufw' (Uncomplicated Firewall) make it easy to set rules that protect your device from attacks.

Result

You see that a firewall acts as a filter, stopping bad network traffic before it reaches your Pi.

Understanding firewalls helps you realize that security is not just about passwords but also about controlling network access.

3

Intermediate

Generating and Using SSH Key Pairs

🤔Before reading on: do you think SSH keys are just complicated passwords or a different method? Commit to your answer.

Concept: Learn how to create SSH key pairs and use them to log in without passwords.

SSH keys come in pairs: a private key you keep secret and a public key you put on your Pi. To generate keys, use 'ssh-keygen' on your computer. Then copy the public key to the Pi's '~/.ssh/authorized_keys' file. When you connect, the Pi checks your private key instead of asking for a password.

Result

You can log into your Raspberry Pi securely without typing a password, using your private key.

Understanding that SSH keys use cryptography to prove identity without sending secrets over the network greatly improves security.

4

Intermediate

Configuring UFW Firewall Rules

🤔Before reading on: do you think a firewall blocks all traffic by default or allows all? Commit to your answer.

Concept: Learn to set up basic firewall rules using UFW to allow SSH and block unwanted access.

Install UFW with 'sudo apt install ufw'. Enable it with 'sudo ufw enable'. Allow SSH connections with 'sudo ufw allow ssh'. You can also allow other services or block all other incoming traffic. Check status with 'sudo ufw status'.

Result

Your Raspberry Pi only accepts network connections you explicitly allow, reducing attack surface.

Knowing how to control network access with simple commands empowers you to protect your device effectively.

5

Intermediate

Disabling Password Authentication for SSH

🤔Before reading on: do you think disabling password login will lock you out if keys are misconfigured? Commit to your answer.

Concept: Learn to disable password login in SSH to force key-based authentication.

Edit the SSH config file '/etc/ssh/sshd_config'. Find 'PasswordAuthentication' and set it to 'no'. Restart SSH with 'sudo systemctl restart ssh'. This stops anyone from logging in with a password, only allowing SSH keys.

Result

Your Raspberry Pi accepts only SSH key logins, making brute-force password attacks impossible.

Understanding this step is critical because it enforces the stronger security method and prevents weak password use.

6

Advanced

Managing Firewall for Multiple Services

🤔Before reading on: do you think firewall rules apply globally or can be set per service and port? Commit to your answer.

Concept: Learn to create detailed firewall rules for different services and ports on your Pi.

Use UFW commands like 'sudo ufw allow 80/tcp' for web servers or 'sudo ufw deny 23' to block Telnet. You can also limit rules to specific IP addresses with 'from' options. This fine control helps secure multiple services running on your Pi.

Result

Your firewall precisely controls which services are reachable, improving security without losing functionality.

Knowing how to tailor firewall rules prevents accidental exposure of sensitive services.

7

Expert

Automating Security with Fail2Ban and Firewall

🤔Before reading on: do you think firewalls alone stop repeated login attempts or do you need extra tools? Commit to your answer.

Concept: Learn to combine firewall with Fail2Ban to automatically block IPs that try to break in.

Fail2Ban monitors log files for failed login attempts and adds temporary firewall rules to block those IPs. Install with 'sudo apt install fail2ban'. Configure jail settings to protect SSH. This dynamic defense stops brute-force attacks in real time.

Result

Your Raspberry Pi actively defends itself by blocking attackers automatically, reducing manual work.

Understanding this layered defense approach shows how automation enhances security beyond static rules.

Under the Hood

SSH keys use cryptographic algorithms to create a pair of linked keys: a private key kept secret and a public key shared with the server. When connecting, the server challenges the client to prove it has the private key without sending it. The firewall inspects network packets and applies rules to accept or drop them based on IP, port, and protocol, acting as a gatekeeper before traffic reaches services.

Why designed this way?

SSH keys were designed to replace vulnerable passwords with cryptography that is nearly impossible to guess or intercept. Firewalls evolved to provide a simple, centralized way to control network access and reduce attack surfaces. Together, they balance security with usability, allowing remote access while blocking threats.

┌───────────────┐       ┌───────────────┐
│ Client (You)  │       │ Raspberry Pi  │
│               │       │               │
│  Private Key  │──────▶│ Public Key    │
│  (Secret)     │       │ (Authorized)  │
└───────────────┘       └───────────────┘
         │                      │
         │ SSH Connection       │
         ▼                      ▼
┌─────────────────────────────────────────┐
│ Firewall (UFW)                         │
│ - Checks incoming packets              │
│ - Allows or blocks based on rules      │
└─────────────────────────────────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Do SSH keys mean you never need a password again? Commit yes or no.

Common Belief: Once you use SSH keys, you don't need any passwords at all.

Reality: SSH keys replace login passwords but your private key itself can be protected by a passphrase, which acts like a password for the key.

Why it matters: Ignoring the passphrase means if someone steals your private key file, they can access your Pi without restriction.

Quick: Does enabling a firewall block all network traffic by default? Commit yes or no.

Common Belief: Turning on the firewall blocks everything unless you open ports first.

Reality: Some firewall tools like UFW allow all outgoing traffic and block incoming by default, but this behavior can be changed. Misunderstanding defaults can cause accidental lockouts or exposure.

Why it matters: Misconfiguring firewall defaults can either leave your Pi open to attacks or make it unreachable remotely.

Quick: Can disabling password authentication lock you out if SSH keys are misconfigured? Commit yes or no.

Common Belief: Disabling password login is always safe once SSH keys are set up.

Reality: If SSH keys are not properly installed or your private key is lost, disabling password login can lock you out completely.

Why it matters: This can cause loss of access requiring physical intervention or reinstalling the OS.

Quick: Does a firewall protect against all types of attacks on your Raspberry Pi? Commit yes or no.

Common Belief: A firewall alone fully protects your Pi from all attacks.

Reality: Firewalls mainly control network access but do not protect against software bugs, physical access, or insider threats.

Why it matters: Relying only on a firewall can give a false sense of security and leave other vulnerabilities open.

Expert Zone

1

SSH keys can use different algorithms (RSA, ECDSA, Ed25519) with varying security and performance; choosing the right one matters for long-term security.

2

Firewalls like UFW are frontends for iptables; understanding iptables allows more complex and precise rules beyond UFW's simplicity.

3

Fail2Ban's effectiveness depends on correct log parsing and timely rule updates; misconfiguration can block legitimate users or miss attackers.

When NOT to use

If your Raspberry Pi is on a trusted, isolated network with no internet access, complex firewall rules and SSH key setups may be unnecessary. In such cases, physical security and simple password protection might suffice. For very high-security environments, consider hardware security modules or VPNs instead.

Production Patterns

In production, Raspberry Pis often use SSH keys combined with centralized management tools for key distribution. Firewalls are configured with automated scripts to match changing network policies. Fail2Ban or similar tools run as services to dynamically block attackers. Logging and monitoring complement these to detect unusual activity early.

Connections

Public Key Infrastructure (PKI)

SSH keys are a practical application of PKI principles for authentication.

Understanding PKI helps grasp how trust and identity verification work in SSH key exchanges.

Physical Security

Network security complements physical security; both are needed to fully protect a device.

Knowing that physical access can bypass network defenses highlights the importance of locking down the device physically.

Airport Security Screening

Like a firewall, airport security screens people and luggage to allow safe passage and block threats.

This cross-domain connection shows how filtering and access control are universal security concepts.

Common Pitfalls

#1 Leaving password authentication enabled after setting up SSH keys.

Wrong approach:

In /etc/ssh/sshd_config:
PasswordAuthentication yes

# Restart SSH service
sudo systemctl restart ssh

Correct approach:

In /etc/ssh/sshd_config:
PasswordAuthentication no

# Restart SSH service
sudo systemctl restart ssh

Root cause:

Not disabling password login leaves a weak entry point open, defeating the purpose of SSH keys.

#2 Enabling UFW without allowing SSH first, causing lockout.

Wrong approach:

sudo ufw enable
sudo ufw allow 80/tcp

Correct approach:

sudo ufw allow ssh
sudo ufw enable
sudo ufw allow 80/tcp

Root cause:

Activating the firewall before allowing SSH blocks remote connections, locking you out.

#3 Copying the private SSH key to the Raspberry Pi instead of the public key.

Wrong approach:

scp ~/.ssh/id_rsa pi@raspberrypi:~/.ssh/authorized_keys

Correct approach:

scp ~/.ssh/id_rsa.pub pi@raspberrypi:~/.ssh/authorized_keys

Root cause:

The private key must remain secret; only the public key goes to the server for authentication.

Key Takeaways

SSH keys provide a much stronger and safer way to log into your Raspberry Pi than passwords.

A firewall controls network access, reducing the chances of unauthorized connections and attacks.

Disabling password authentication after setting up SSH keys is crucial to prevent weak entry points.

Automated tools like Fail2Ban can enhance security by blocking repeated attack attempts dynamically.

Proper configuration and understanding of these tools prevent lockouts and ensure your Raspberry Pi stays secure.