Take the 2-minute tour ×
Raspberry Pi Stack Exchange is a question and answer site for users and developers of hardware and software for Raspberry Pi. It's 100% free, no registration required.

Having tens of thousands of Raspberry Pi's connected to the internet is eventually going to capture the interest of some people who would like to do unsavory things to the little computers especially when many people are using their Pi to do network servers. Linux is a solid OS out of the box security wise, but aside from just changing the password what should be done to "harden" the Raspberry Pi if I intend to host internet facing services on the device?

Just to support my "tens of thousands" quip, Eben Upton has said that "The Raspberry Pi has sold over 200,000 of its basic computer modules and is currently shipping 4,000 units a day". Its probably safe to assume tens of thousands of those 200,000 have been connected to the internet. It is less safe to assume that tens of thousands of those internet connected Raspberry Pis are hosting a public facing web service, but the potential for hacker enthusiasm still exists.

share|improve this question
3  
Keep in mind that though there may be "tens of thousands" connected, there are (currently) 3 separate Linux distros available (that I'm aware of) and I think there are even a few non-linux based projects out there. This affects the perspective of the hacker. Still, if security is important, keep your distro updated and, if necessary, keep your device behind a firewall. –  RLH Jul 24 '12 at 14:39
    
Good point RLH I'll add some additional information to the question that supports the number of Raspberry Pis in the wild to give a better idea of the Raspberry Pi's attack surface Steve mentioned in his answer. –  Dan B Jul 24 '12 at 16:49
    
@DanB Attack surface is not a function of the number of Pi's but rather the number of systems and services available for attack. en.wikipedia.org/wiki/Attack_surface –  Steve Robillard Jul 24 '12 at 17:01
    
@SteveRobillard Sorry if I was unclear in the comment, but in the edit I made to the question I attempted to boil down in a qualitative sort of way the number of Pis that are hosting public facing services and would therefore present a service available for attack. –  Dan B Jul 24 '12 at 17:26
add comment

3 Answers 3

up vote 19 down vote accepted

Securing a computer is not a simple process, entire books are written on the topic. The Pi's size does not reduce the security threat or attack surface presented to a possible attacker. As a result, I will describe the steps involved and provide links to more detailed instructions and tutorials.

Since you have not mentioned what distro you are using I will assume the recommended Raspbian Distro.

  1. Change the default password. The Raspbian distro includes this as an option in the initial startup script. If you did not do this already you can use the passwd command to change it. Make sure to choose a strong password.
  2. Disable unused services. I saw that the recommended Raspbian distro includes the Apache web server and enables it at startup (can someone confirm this). Do you really need a web server running? If not disable it. If you do need to run Apache be sure to secure it, and do likewise for other service (e.g. FTP, NGINX, MySQL etc.), A google search should turn up several resources.
  3. Install and configure iptables.
  4. Keep your system up to date. You can automate this using cron or using cron-apt.
  5. Configure logging to monitor logins and failed login attempts. If possible use an external Hard drive to host you /var partition, this will give you more space, avoid the log files from filling up the SD Card and extend the life of your SD Card.

Some additional things you may want to consider:

You should also read this related question How can I protect against intrusion and malware before connecting it to the internet (especially on a public IP address)?.

This is only the bare minimum steps for securing your Pi. For more info you may want to read the Securing Debian Manual.

share|improve this answer
    
Thanks Steve this is exactly what I was looking for. –  Dan B Jul 24 '12 at 15:37
4  
Make sure to generate your own ssh keys. I think some of the images had keys already in them. –  John La Rooy Jul 24 '12 at 22:33
    
@gnibbler good point I was just trying to confirm this was true, and that they weren't generated on install/enabling SSH. –  Steve Robillard Jul 24 '12 at 22:50
    
Apache is not installed in raspbian by default (the user installed something like php5-mysql IIRC). For a packet filter which is a bit more friendly than the naked iptables, maybe we should recommend ufw and perhaps even its GUI frontend gufw? –  elmicha Jul 26 '12 at 22:26
1  
@otakun85 Yes, it is called defense in depth. By relying completely on your router should someone get past your router having iptables up and running makes further exploits more difficult. –  Steve Robillard Jul 27 '12 at 6:20
show 2 more comments

linode has an excellent guide on securing a linux server: http://library.linode.com/securing-your-server. the same rules can be applied to the raspberry pi

share|improve this answer
add comment

Having looked at the RPi, it seems like a fairly secure device out the box, as long as you do a couple of things.

The default user/pass needs changed. At the very least, change the password. For better security again, change the username as well. (Add a new user, then disable PI. Check that ROOT is also disabled from SSH login, though I think it is by default anyway.)

Scanning the RPi returns only one open port, 22, which is the SSH connection, and even that has to be turned on before it shows (though most people will be using it instead of a monitor, keyboard and mouse, I expect, especially on a {web}server)

You could change the SSH port number, but that won't do much, since it can be port scanned easily enough. Instead, enable SSH-Key authentication.

You now have no way for anyone to get into your machine without the correct SSH key, username, and password.

Next, set up your webserver. Apache is pretty much where it is at. That will sit and monitor port 80 as default, and automatically response to connections from browsers, serving your webpages.

If you have a firewall or router, you could change the RPi ports, and have the router direct the traffic from one port to the other. For example, port 80 traffic into the router is redirected to port 75 on the RPi, and SSH on 22 is redirected to port 72. This would add another layer of protection, but is a little more complex.

Keep everything updated and patched, obviously.

This won't protect you from attacks that exploit java, flash, SQL servers, etc that you might well add on later, but that's it for the basics, really.

You could also add a firewall, which will slow down anyone who gets into your system from getting out on a different port if they install a new service. Your router should be dealing with that, but if it is directly connected, then set it up, and, for how long it takes, you might as well be running it anyway - it won't add much in the way of system resources.

One other thing you might want to add is fail2ban (http://www.fail2ban.org/wiki/index.php/Main_Page) which adds a firewall rule to block multiple log-in attempts, preventing dictionary attacks. Although these can't work on your system if you've followed the above, if you for some reason need to leave password only SSH auth in place (you remote login from many different machines, for example) then it will prevent a dictionary attack from working. After the number of attempts you specify, it will block for a time any more attempts from that IP address. (Just take care that it doesn't see any router/local IP address and ban that too early or for too long!)

Edited to add: Once you've got everything set up nicely, use a tool like dd or Win32DiskImager to take a complete bit-wise backup of your SD card. That way, if anything goes wrong, you can restore it to the same card or write it to a new card, and carry on regardless. (But if hacked, you'd want to work out what hole was found and close that first, perhaps!)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.