Securing Raspberry Pi (SSH keys, firewall) - Step-by-Step Execution

Concept Flow - Securing Raspberry Pi (SSH keys, firewall)

Generate SSH Key Pair

↓

Copy Public Key to Pi

↓

Disable Password Login

↓

Configure Firewall Rules

↓

Test SSH Connection

↓

Secure Pi Access Established

This flow shows the steps to secure Raspberry Pi by setting up SSH keys and firewall rules to allow safe remote access.

Execution Sample

Raspberry Pi

ssh-keygen -t ed25519
ssh-copy-id pi@raspberrypi
sudo ufw allow ssh
sudo ufw enable

This code generates SSH keys, copies the public key to the Pi, allows SSH through the firewall, and enables the firewall.

Execution Table

Step	Action	Command/Setting	Result	Next Step
1	Generate SSH key pair on local machine	ssh-keygen -t ed25519	Created private and public keys	Copy public key to Pi
2	Copy public key to Raspberry Pi	ssh-copy-id pi@raspberrypi	Public key added to Pi's authorized_keys	Disable password login
3	Disable password login on Pi	Edit /etc/ssh/sshd_config to set PasswordAuthentication no	Password login disabled, only keys allowed	Configure firewall
4	Allow SSH through firewall	sudo ufw allow ssh	Firewall rule added to allow SSH port 22	Enable firewall
5	Enable firewall	sudo ufw enable	Firewall activated with SSH allowed	Test SSH connection
6	Test SSH connection	ssh pi@raspberrypi	Connected without password prompt	Secure Pi access established
7	End	-	SSH key authentication and firewall active	Process complete

💡 SSH key authentication works and firewall blocks unwanted access, securing the Raspberry Pi.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5	Final
SSH Keys	None	Keys generated	Public key copied to Pi	Password login disabled	Firewall allows SSH	Firewall enabled	SSH key auth active
Firewall Status	Disabled	Disabled	Disabled	Disabled	Rule added	Enabled	Active with SSH allowed
SSH Access	Password login	Password login	Key login enabled	Password login disabled	Key login enabled	Key login enabled	Key login only

Key Moments - 3 Insights

Why do we disable password login after copying the SSH key?

Disabling password login (Step 3) ensures only devices with the private SSH key can connect, improving security as shown in execution_table row 3.

What happens if the firewall does not allow SSH port 22?

If the firewall blocks SSH (before Step 4), remote connections fail even with correct keys. Execution_table row 4 shows adding the rule to allow SSH.

Why test SSH connection at the end?

Testing (Step 6) confirms the setup works: SSH connects without password prompt and firewall allows it, as shown in execution_table row 6.

Visual Quiz - 3 Questions

Look at the execution_table, what is the result after Step 2?

A Public key added to Pi's authorized_keys

B Firewall enabled

C Password login disabled

D SSH connection tested

💡 Hint

Check the 'Result' column for Step 2 in the execution_table.

At which step is the firewall activated?

A Step 4

B Step 3

C Step 5

D Step 6

💡 Hint

Look for 'Firewall activated' in the 'Result' column of execution_table.

If password login is not disabled, what changes in the variable_tracker for SSH Access?

A SSH Access changes to 'Key login only' after Step 3

B SSH Access remains 'Password login' after Step 3

C Firewall Status changes to 'Enabled' earlier

D SSH Keys are not generated

💡 Hint

Check the 'SSH Access' row in variable_tracker after Step 3.

Concept Snapshot

Securing Raspberry Pi:
1. Generate SSH key pair locally (ssh-keygen).
2. Copy public key to Pi (ssh-copy-id).
3. Disable password login in sshd_config.
4. Allow SSH port in firewall (ufw allow ssh).
5. Enable firewall (ufw enable).
6. Test SSH connection uses keys only.

Full Transcript

This visual execution shows how to secure a Raspberry Pi by using SSH keys and firewall rules. First, you generate an SSH key pair on your local machine. Then, you copy the public key to the Pi to allow key-based login. Next, you disable password login on the Pi to prevent password attacks. After that, you configure the firewall to allow SSH connections and enable it. Finally, you test the SSH connection to confirm it works without a password prompt. The variable tracker shows how SSH keys, firewall status, and SSH access method change step-by-step. Key moments clarify why disabling password login and firewall rules are important. The quiz tests understanding of each step's result and effects on security.

Practice

1. What is the main benefit of using SSH keys instead of passwords to access your Raspberry Pi?

easy

A. It improves security by avoiding password guessing attacks.

B. It makes the Raspberry Pi run faster.

C. It allows multiple users to share the same password.

D. It disables the firewall automatically.

Solution

1. Step 1: Understand SSH key authentication

   SSH keys use a pair of cryptographic keys to authenticate users without sending passwords over the network.

2. Step 2: Compare with password authentication

   Password authentication can be vulnerable to guessing or brute force attacks, while SSH keys are much harder to crack.

3. Final Answer:

   It improves security by avoiding password guessing attacks. -> Option A

4. Quick Check:

   SSH keys = better security [OK]

Hint: SSH keys stop password guessing attacks fast [OK]

Common Mistakes:

• Thinking SSH keys make the device faster
• Believing SSH keys share passwords
• Assuming SSH keys disable firewall

2. Which command correctly generates an SSH key pair on your Raspberry Pi?

easy

A. ssh-keygen --firewall

B. ssh-keygen -p rsa

C. ssh-keygen -t rsa

D. firewall-cmd --generate-key

Solution

1. Step 1: Identify the SSH key generation command

   The standard command to create SSH keys is ssh-keygen with the -t option to specify the type, e.g., rsa.

2. Step 2: Check options for correctness

   -p changes the passphrase, --firewall and firewall-cmd are unrelated to SSH keys.

3. Final Answer:

   ssh-keygen -t rsa -> Option C

4. Quick Check:

   ssh-keygen -t rsa = generate SSH keys [OK]

Hint: Use ssh-keygen with -t to specify key type [OK]

Common Mistakes:

• Using -p instead of -t for key generation
• Confusing firewall commands with SSH key commands
• Trying to generate keys with firewall tools

3. Given the following commands run on a Raspberry Pi, what will be the output of sudo ufw status?

sudo ufw enable
sudo ufw allow ssh
sudo ufw deny 80

medium

A. Error: ufw command not found

B. Status: inactive

C. Status: active
No rules defined

D. Status: active
To Action From
-- ------ ----
22/tcp ALLOW Anywhere
80 DENY Anywhere

Solution

1. Step 1: Analyze the firewall commands

   sudo ufw enable activates the firewall. sudo ufw allow ssh opens port 22 (SSH). sudo ufw deny 80 blocks HTTP port 80.

2. Step 2: Understand the status output

   The status shows active firewall with rules allowing SSH (port 22) and denying port 80.

3. Final Answer:

   Status: active To Action From -- ------ ---- 22/tcp ALLOW Anywhere 80 DENY Anywhere -> Option D

4. Quick Check:

   Firewall enabled with SSH allow and port 80 deny = Status: active To Action From -- ------ ---- 22/tcp ALLOW Anywhere 80 DENY Anywhere [OK]

Hint: Enable ufw then add rules to see them in status [OK]

Common Mistakes:

• Assuming firewall is inactive after enabling
• Expecting no rules after adding allow/deny
• Confusing port numbers with service names

4. You tried to add your SSH public key to ~/.ssh/authorized_keys but still get password prompts. What is the most likely cause?

medium

A. The authorized_keys file has incorrect permissions.

B. The Raspberry Pi firewall is disabled.

C. You forgot to restart the SSH service.

D. You used the wrong SSH key type.

Solution

1. Step 1: Check SSH key authentication requirements

   SSH requires strict permissions on ~/.ssh and authorized_keys files to allow key login.

2. Step 2: Identify common permission issues

   If permissions are too open, SSH ignores the keys and falls back to password login.

3. Final Answer:

   The authorized_keys file has incorrect permissions. -> Option A

4. Quick Check:

   Wrong permissions block SSH key login [OK]

Hint: Check .ssh and authorized_keys permissions first [OK]

Common Mistakes:

• Thinking firewall affects SSH key login
• Restarting SSH service unnecessarily
• Assuming wrong key type without checking permissions

5. You want to secure your Raspberry Pi by allowing SSH access only from a specific IP address 192.168.1.100 and blocking all other SSH attempts. Which ufw commands achieve this?

hard

A. sudo ufw allow from any to any port 22
sudo ufw deny from 192.168.1.100

B. sudo ufw allow from 192.168.1.100 to any port 22
sudo ufw deny 22

C. sudo ufw deny ssh
sudo ufw allow 22

D. sudo ufw allow ssh
sudo ufw deny from 192.168.1.100 to any port 22

Solution

1. Step 1: Allow SSH only from the specific IP

   Use sudo ufw allow from 192.168.1.100 to any port 22 to permit SSH from that IP.

2. Step 2: Deny all other SSH connections

   Use sudo ufw deny 22 to block SSH from all other IPs.

3. Final Answer:

   sudo ufw allow from 192.168.1.100 to any port 22 sudo ufw deny 22 -> Option B

4. Quick Check:

   Allow specific IP then deny all others = sudo ufw allow from 192.168.1.100 to any port 22 sudo ufw deny 22 [OK]

Hint: Allow specific IP first, then deny all others [OK]

Common Mistakes:

• Allowing SSH globally before denying specific IP
• Denying the allowed IP instead of others
• Using wrong port numbers or commands