Securing Raspberry Pi (SSH keys, firewall) - Mini Project: Build & Apply

Securing Raspberry Pi with SSH Keys and Firewall

📖 Scenario: You have a Raspberry Pi that you want to keep safe from unwanted access. You will set up secure login using SSH keys instead of passwords and configure a firewall to allow only safe connections.

🎯 Goal: Learn how to create SSH keys, copy the public key to the Raspberry Pi, and set up a firewall to block unwanted network traffic.

📋 What You'll Learn

Create SSH key pair on your local machine

Copy the public SSH key to Raspberry Pi's authorized keys

Configure Raspberry Pi firewall to allow SSH and block other incoming connections

Verify secure SSH login and firewall status

💡 Why This Matters

🌍 Real World

Keeping your Raspberry Pi secure is important when it is connected to your home or work network. Using SSH keys and a firewall helps prevent unauthorized access.

💼 Career

System administrators and IoT developers often secure devices remotely using SSH keys and firewalls to protect sensitive data and services.

1

Generate SSH Key Pair on Local Machine

Open your terminal and run ssh-keygen -t rsa -b 4096 -f ~/.ssh/pi_rsa to create a new SSH key pair named pi_rsa in your .ssh folder.

Raspberry Pi

# Run the ssh-keygen command below
# Your code here

Hint

This command creates a secure RSA key with 4096 bits and saves it as pi_rsa in your SSH folder.

2

Copy Public SSH Key to Raspberry Pi

Use ssh-copy-id -i ~/.ssh/pi_rsa.pub [e-mail] to copy your public key to the Raspberry Pi user pi. Replace raspberrypi.local with your Pi's address if different.

Raspberry Pi

ssh-keygen -t rsa -b 4096 -f ~/.ssh/pi_rsa
# Copy the public key to Raspberry Pi below
# Your code here

Hint

This command sends your public key to the Raspberry Pi so you can log in without a password.

3

Configure Firewall to Allow SSH Only

On the Raspberry Pi, run sudo ufw allow ssh to allow SSH connections, then run sudo ufw enable to activate the firewall blocking other incoming traffic.

Raspberry Pi

ssh-keygen -t rsa -b 4096 -f ~/.ssh/pi_rsa
ssh-copy-id -i ~/.ssh/pi_rsa.pub [e-mail]
# Configure firewall commands below
# Your code here

Hint

The ufw tool manages the firewall. Allow SSH and then enable the firewall.

4

Verify SSH Login and Firewall Status

Run ssh -i ~/.ssh/pi_rsa [e-mail] to log in using your SSH key. Then run sudo ufw status on the Pi to check the firewall is active and only SSH is allowed.

Raspberry Pi

ssh-keygen -t rsa -b 4096 -f ~/.ssh/pi_rsa
ssh-copy-id -i ~/.ssh/pi_rsa.pub [e-mail]
sudo ufw allow ssh
sudo ufw enable
# Verify SSH login and firewall status below
# Your code here

Hint

Use your SSH key to connect and check the firewall rules to confirm security.

Practice

1. What is the main benefit of using SSH keys instead of passwords to access your Raspberry Pi?

easy

A. It improves security by avoiding password guessing attacks.

B. It makes the Raspberry Pi run faster.

C. It allows multiple users to share the same password.

D. It disables the firewall automatically.

Solution

1. Step 1: Understand SSH key authentication

   SSH keys use a pair of cryptographic keys to authenticate users without sending passwords over the network.

2. Step 2: Compare with password authentication

   Password authentication can be vulnerable to guessing or brute force attacks, while SSH keys are much harder to crack.

3. Final Answer:

   It improves security by avoiding password guessing attacks. -> Option A

4. Quick Check:

   SSH keys = better security [OK]

Hint: SSH keys stop password guessing attacks fast [OK]

Common Mistakes:

• Thinking SSH keys make the device faster
• Believing SSH keys share passwords
• Assuming SSH keys disable firewall

2. Which command correctly generates an SSH key pair on your Raspberry Pi?

easy

A. ssh-keygen --firewall

B. ssh-keygen -p rsa

C. ssh-keygen -t rsa

D. firewall-cmd --generate-key

Solution

1. Step 1: Identify the SSH key generation command

   The standard command to create SSH keys is ssh-keygen with the -t option to specify the type, e.g., rsa.

2. Step 2: Check options for correctness

   -p changes the passphrase, --firewall and firewall-cmd are unrelated to SSH keys.

3. Final Answer:

   ssh-keygen -t rsa -> Option C

4. Quick Check:

   ssh-keygen -t rsa = generate SSH keys [OK]

Hint: Use ssh-keygen with -t to specify key type [OK]

Common Mistakes:

• Using -p instead of -t for key generation
• Confusing firewall commands with SSH key commands
• Trying to generate keys with firewall tools

3. Given the following commands run on a Raspberry Pi, what will be the output of sudo ufw status?

sudo ufw enable
sudo ufw allow ssh
sudo ufw deny 80

medium

A. Error: ufw command not found

B. Status: inactive

C. Status: active
No rules defined

D. Status: active
To Action From
-- ------ ----
22/tcp ALLOW Anywhere
80 DENY Anywhere

Solution

1. Step 1: Analyze the firewall commands

   sudo ufw enable activates the firewall. sudo ufw allow ssh opens port 22 (SSH). sudo ufw deny 80 blocks HTTP port 80.

2. Step 2: Understand the status output

   The status shows active firewall with rules allowing SSH (port 22) and denying port 80.

3. Final Answer:

   Status: active To Action From -- ------ ---- 22/tcp ALLOW Anywhere 80 DENY Anywhere -> Option D

4. Quick Check:

   Firewall enabled with SSH allow and port 80 deny = Status: active To Action From -- ------ ---- 22/tcp ALLOW Anywhere 80 DENY Anywhere [OK]

Hint: Enable ufw then add rules to see them in status [OK]

Common Mistakes:

• Assuming firewall is inactive after enabling
• Expecting no rules after adding allow/deny
• Confusing port numbers with service names

4. You tried to add your SSH public key to ~/.ssh/authorized_keys but still get password prompts. What is the most likely cause?

medium

A. The authorized_keys file has incorrect permissions.

B. The Raspberry Pi firewall is disabled.

C. You forgot to restart the SSH service.

D. You used the wrong SSH key type.

Solution

1. Step 1: Check SSH key authentication requirements

   SSH requires strict permissions on ~/.ssh and authorized_keys files to allow key login.

2. Step 2: Identify common permission issues

   If permissions are too open, SSH ignores the keys and falls back to password login.

3. Final Answer:

   The authorized_keys file has incorrect permissions. -> Option A

4. Quick Check:

   Wrong permissions block SSH key login [OK]

Hint: Check .ssh and authorized_keys permissions first [OK]

Common Mistakes:

• Thinking firewall affects SSH key login
• Restarting SSH service unnecessarily
• Assuming wrong key type without checking permissions

5. You want to secure your Raspberry Pi by allowing SSH access only from a specific IP address 192.168.1.100 and blocking all other SSH attempts. Which ufw commands achieve this?

hard

A. sudo ufw allow from any to any port 22
sudo ufw deny from 192.168.1.100

B. sudo ufw allow from 192.168.1.100 to any port 22
sudo ufw deny 22

C. sudo ufw deny ssh
sudo ufw allow 22

D. sudo ufw allow ssh
sudo ufw deny from 192.168.1.100 to any port 22

Solution

1. Step 1: Allow SSH only from the specific IP

   Use sudo ufw allow from 192.168.1.100 to any port 22 to permit SSH from that IP.

2. Step 2: Deny all other SSH connections

   Use sudo ufw deny 22 to block SSH from all other IPs.

3. Final Answer:

   sudo ufw allow from 192.168.1.100 to any port 22 sudo ufw deny 22 -> Option B

4. Quick Check:

   Allow specific IP then deny all others = sudo ufw allow from 192.168.1.100 to any port 22 sudo ufw deny 22 [OK]

Hint: Allow specific IP first, then deny all others [OK]

Common Mistakes:

• Allowing SSH globally before denying specific IP
• Denying the allowed IP instead of others
• Using wrong port numbers or commands