https://bradnor.ddns.net/bradnorwiki/index.php?action=history&feed=atom&title=Hardening_security 2026-04-05T18:00:13Z Revision history for this page on the wiki MediaWiki 1.45.1 https://bradnor.ddns.net/bradnorwiki/index.php?title=Hardening_security&diff=2617&oldid=prev 2021-05-17T12:15:01Z

<p></p> <p><b>New page</b></p><div>[[Basic_Install|&amp;lArr; Basic Install]]<br /> <br /> ==Disabling root and pi accounts==<br /> ;We need to change passwords and/or disable root and pi usernames.<br /> <br /> ::First create our own account (logged in as pi)<br /> :::&lt;tt&gt;sudo /usr/sbin/useradd --groups sudo --shell /bin/bash -m &lt;myusername&gt;&lt;/tt&gt;<br /> :::&lt;tt&gt;sudo passwd &lt;myusername&gt;&lt;/tt&gt;<br /> <br /> ;Login as the new username and change root and pi passwords<br /> <br /> ::&lt;tt&gt;sudo passwd root&lt;/tt&gt;<br /> ::&lt;tt&gt;sudo passwd pi&lt;/tt&gt;<br /> ::&lt;tt&gt;sudo passwd --lock p&lt;/tt&gt;i<br /> <br /> ==Securing ssh==<br /> ;Create a key on the host you are attaching from (if not already done so)<br /> <br /> ::&lt;tt&gt;ssh-keygen -t rsa&lt;/tt&gt;<br /> :::providing a keyphrase<br /> ::Copy the created key (in ~/.ssh) to the raspberrypi<br /> :::&lt;tt&gt;ssh-copy-id -i ~/.ssh/id_rsa.pub &lt;remote_user&gt;@&lt;remote_host&gt;&lt;/tt&gt;<br /> ::Add host key to known hosts - (this removes existing entry (if any) and allows new host key to be added to the ~.ssh/known_hosts file at next ssh login<br /> :::&lt;tt&gt;ssh-keygen –R &lt;remote_host&gt;&lt;/tt&gt;<br /> ::login to host with ssh<br /> <br /> ;Disable password authentication for ssh<br /> <br /> ::Edit the ssh config file<br /> :::&lt;tt&gt;sudo emacs /etc/ssh/sshd_config&lt;/tt&gt;<br /> ::::and set<br /> :::::PasswordAuthentication no<br /> :::::PermitRootLogin no<br /> :::::UsePAM no<br /> <br /> ;Load new ssh configuration and restart<br /> ::&lt;tt&gt;sudo service /etc/init.d/ssh reload&lt;/tt&gt;<br /> ::&lt;tt&gt;sudo service ssh restart&lt;/tt&gt;<br /> <br /> ==Enabling Firewall==<br /> ;for older Raspbian<br /> ::Install iptables<br /> :::&lt;tt&gt;sudo apt-get install iptables iptables-persistent&lt;/tt&gt;<br /> :check iptables<br /> ::&lt;tt&gt;sudo /sbin/iptables -L&lt;/tt&gt;<br /> ;for Buster<br /> :use nftables<br /> <br /> ==Securing wpa_supplicant==<br /> ;encrypt the wifi access password in wpa_supplicant<br /> :encrypt the section for wpa_supplicant which contains the wifi password, by running<br /> ::&lt;tt&gt;wpa_passphrase &#039;&#039;&lt;YOUR_SSID&gt; &lt;YOUR_PASSWORD&gt;&#039;&#039;&lt;/tt&gt;<br /> :cut and paste the output into the file<br /> ::&lt;tt&gt;/etc/wpa_supplicant/wpa_supplicant.conf&lt;/tt&gt;<br /> :removing the existing &lt;tt&gt;network={&lt;/tt&gt; section and removing the commented out line line &lt;tt&gt;#psk=&lt;/tt&gt; that has the unencrypted password<br /> ::</div>

Ch