What should be done to secure Raspberry Pi?

Question

Having tens of thousands of Raspberry Pi's connected to the internet is eventually going to capture the interest of some people who would like to do unsavory things to the little computers especially when many people are using their Pi to do network servers. Linux is a solid OS out of the box security wise, but aside from just changing the password what should be done to "harden" the Raspberry Pi if I intend to host internet facing services on the device?

Just to support my "tens of thousands" quip, Eben Upton has said that "The Raspberry Pi has sold over 200,000 of its basic computer modules and is currently shipping 4,000 units a day". Its probably safe to assume tens of thousands of those 200,000 have been connected to the internet. It is less safe to assume that tens of thousands of those internet connected Raspberry Pis are hosting a public facing web service, but the potential for hacker enthusiasm still exists.

Answer 1

Securing a computer is not a simple process, entire books are written on the topic. The Pi's size does not reduce the security threat or attack surface presented to a possible attacker. As a result, I will describe the steps involved and provide links to more detailed instructions and tutorials.

Since you have not mentioned what distro you are using I will assume the recommended Raspbian Distro.

1. Change the default password. The Raspbian distro includes this as an option in the initial startup script. If you did not do this already you can use the passwd command to change it. Make sure to choose a strong password.
2. Disable unused services. I saw that the recommended Raspbian distro includes the Apache web server and enables it at startup (can someone confirm this). Do you really need a web server running? If not disable it. If you do need to run Apache be sure to secure it, and do likewise for other service (e.g. FTP, NGINX, MySQL etc.), A google search should turn up several resources.
3. Install and configure iptables.
4. Keep your system up to date. You can automate this using cron or using cron-apt.
5. Configure logging to monitor logins and failed login attempts. If possible use an external Hard drive to host you /var partition, this will give you more space, avoid the log files from filling up the SD Card and extend the life of your SD Card.

Some additional things you may want to consider:

• Install virus protection.
• Setup and configure SELinux.

You should also read this related question How can I protect against intrusion and malware before connecting it to the internet (especially on a public IP address)?.

This is only the bare minimum steps for securing your Pi. For more info you may want to read the Securing Debian Manual.

Answer 2

Having looked at the RPi, it seems like a fairly secure device out the box, as long as you do a couple of things.

The default user/pass needs changed. At the very least, change the password. For better security again, change the username as well. (Add a new user, then disable PI. Check that ROOT is also disabled from SSH login, though I think it is by default anyway.)

Scanning the RPi returns only one open port, 22, which is the SSH connection, and even that has to be turned on before it shows (though most people will be using it instead of a monitor, keyboard and mouse, I expect, especially on a {web}server)

You could change the SSH port number, but that won't do much, since it can be port scanned easily enough. Instead, enable SSH-Key authentication.

You now have no way for anyone to get into your machine without the correct SSH key, username, and password.

Next, set up your webserver. Apache is pretty much where it is at. That will sit and monitor port 80 as default, and automatically response to connections from browsers, serving your webpages.

If you have a firewall or router, you could change the RPi ports, and have the router direct the traffic from one port to the other. For example, port 80 traffic into the router is redirected to port 75 on the RPi, and SSH on 22 is redirected to port 72. This would add another layer of protection, but is a little more complex.

Keep everything updated and patched, obviously.

This won't protect you from attacks that exploit java, flash, SQL servers, etc that you might well add on later, but that's it for the basics, really.

You could also add a firewall, which will slow down anyone who gets into your system from getting out on a different port if they install a new service. Your router should be dealing with that, but if it is directly connected, then set it up, and, for how long it takes, you might as well be running it anyway - it won't add much in the way of system resources.

One other thing you might want to add is fail2ban (http://www.fail2ban.org/wiki/index.php/Main_Page) which adds a firewall rule to block multiple log-in attempts, preventing dictionary attacks. Although these can't work on your system if you've followed the above, if you for some reason need to leave password only SSH auth in place (you remote login from many different machines, for example) then it will prevent a dictionary attack from working. After the number of attempts you specify, it will block for a time any more attempts from that IP address. (Just take care that it doesn't see any router/local IP address and ban that too early or for too long!)

Edited to add: Once you've got everything set up nicely, use a tool like dd or Win32DiskImager to take a complete bit-wise backup of your SD card. That way, if anything goes wrong, you can restore it to the same card or write it to a new card, and carry on regardless. (But if hacked, you'd want to work out what hole was found and close that first, perhaps!)

Answer 3

linode has an excellent guide on securing a linux server: http://library.linode.com/securing-your-server. the same rules can be applied to the raspberry pi

Answer 4

Several posters have mentioned the importance of keeping your Pi up-to-date, but most resources I've found simply suggest manually running apt-get from time-to-time, which seems like a poor approach. I'd much prefer to have security updates automatically installed.

The Debian unattended-upgrades package is supposed to support this, but (on Raspbian?) it's a bit fiddly to set up.

• You need to run sudo dpkg-reconfigure -plow unattended-upgrades to actually schedule the update cronjob
• You may need to add origin= entries for Raspbian - several posts suggest adding custom entries to the config file for origin=Raspbian and origin=Raspberry Pi Foundation, but I don't know how exactly to validate the setup. It's too bad the origins (seem to) require manual tweaking.
• Also consider:
  • Setting up mailx and uncommenting the Unattended-Upgrade::Mail and Unattended-Upgrade::MailOnlyOnError to get notifications about updates
  • Unattended-Upgrade::MinimalSteps also seems like a good idea

Run sudo unattended-upgrade -d --dry-run to see what it would do (though it's similarly not terribly informative, since it will report no updates on a recently-updated system).

Answer 5

You could also consider using Lynis. It scans your system for vulnerablilities and provides suggestions to improve the security of your Pi. It even gives you a security score on how well secured your Pi is.

To install it use:

sudo apt install lynis

The repository is most likely out of date so update lynis by adding a key first using

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys C80E383C3DE9F082E01391A0366C67DE91CA5D5F

then add the repos

sudo apt install apt-transport-https

and

echo "deb https://packages.cisofy.com/community/lynis/deb/ stable main" | sudo tee /etc/apt/sources.list.d/cisofy-lynis.list

Finally, do sudo apt update to update lynis

I know that this is an old post but I wanted to add to it. Hope it helps :)

Answer 6

As well as hardening the OS you can also consider using a cloud based security monitoring service to monitor the activity to / from / on your device and receive alerts if anything untoward is detected. There are a few cloud based SIEM tools available nowadays, and some (like siemless) operate a freemium model so home users do not have to pay a penny. To use such a servcie you'll need to familiarise yourself with things like rsyslog / syslog which is a standard part of all Linux OS distributions.