How to Secure a Raspberry Pi Exposed to the Internet

Exposing a Raspberry Pi to the internet—whether for a web server, VPN, or home automation hub—opens it to constant scanning and attack. This guide walks you through the essential hardening steps: changing default credentials, updating software, configuring a firewall, using key-based SSH, and optionally setting up fail2ban and automatic security updates. By the end, your Pi will be significantly less vulnerable to common exploits.

What You’ll Need

• A Raspberry Pi running Raspberry Pi OS (or another Debian-based Linux distribution)
• Access to the Pi via keyboard/monitor or SSH
• Administrative (sudo) privileges
• An internet connection

Step-by-Step

1. Update and upgrade the system. Run sudo apt update && sudo apt upgrade -y to install the latest security patches. Reboot if the kernel was updated.
2. Change the default password. The default user pi has a well-known password. Run passwd and set a strong, unique password. Better yet, create a new user with sudo adduser yourname and add them to the sudo group with sudo usermod -aG sudo yourname, then remove the pi user: sudo deluser pi (or sudo deluser -remove-home pi to delete their home directory).
3. Enable automatic security updates. Install unattended-upgrades: sudo apt install unattended-upgrades. Then run sudo dpkg-reconfigure unattended-upgrades and select “Yes” to enable automatic updates for security patches.
4. Configure SSH for key-based authentication only. If you need SSH access, generate an SSH key pair on your local machine (e.g., ssh-keygen -t ed25519), copy the public key to the Pi with ssh-copy-id user@pi-ip, then edit /etc/ssh/sshd_config to set PasswordAuthentication no, PermitRootLogin no, and PubkeyAuthentication yes. Restart SSH with sudo systemctl restart ssh.
5. Set up a firewall. Install UFW: sudo apt install ufw. Allow only the ports you need, e.g., sudo ufw allow 22/tcp (SSH), sudo ufw allow 80/tcp (HTTP), sudo ufw allow 443/tcp (HTTPS). Then enable it with sudo ufw enable. Check status with sudo ufw status.
6. Install and configure fail2ban. Run sudo apt install fail2ban. Create a local config file /etc/fail2ban/jail.local with settings like:

   [sshd]
   enabled = true
   maxretry = 3
   bantime = 3600

   Restart fail2ban: sudo systemctl restart fail2ban.

7. Disable unnecessary services. Check running services with sudo systemctl list-units --type=service --state=running. Stop and disable anything you don’t need, e.g., sudo systemctl disable --now bluetooth if you don’t use it.
8. Use a non-standard SSH port (optional). Changing the SSH port from 22 to something like 2222 reduces automated scan attempts. Edit /etc/ssh/sshd_config to set Port 2222, then restart SSH. Remember to update your firewall rules accordingly.
9. Set up a reverse proxy or VPN for web services. If you’re running a web server, consider using a reverse proxy like Nginx with TLS/SSL (Let’s Encrypt) to encrypt traffic. For remote management, a VPN (e.g., WireGuard or OpenVPN) is safer than exposing SSH directly.
10. Monitor logs regularly. Set up logwatch or simply check /var/log/auth.log periodically for suspicious activity. You can also use sudo journalctl -u ssh to review SSH logs.

Common Mistakes

• Leaving the default user and password. The default ‘pi’ user is a prime target for brute-force attacks.
• Keeping port 22 open. Even with key-based auth, bots will hammer port 22. Changing the port helps reduce noise.
• Forgetting to update the firewall after changing SSH port. If you change the port but don’t allow it in UFW, you’ll lock yourself out.
• Disabling password authentication before testing key login. Always test key-based SSH in a separate session before disabling passwords.
• Running unnecessary services. Every open port is an attack surface. Only expose what you truly need.

Tips

• Use a strong passphrase for your SSH private key.
• Consider using a firewall at your router level as well, forwarding only specific ports to the Pi.
• Regularly back up your Pi’s configuration and data, especially before major updates.
• Use a tool like sshguard as an alternative to fail2ban if you prefer.
• Keep your Pi’s software updated automatically; this is the single most effective measure against known vulnerabilities.

Troubleshooting

You get locked out of SSH after changing the port or disabling passwords. If you have physical access, connect a monitor and keyboard, and revert the changes. If not, use your hosting provider’s console (if applicable). Always keep a secondary way in, like a physical console or a scheduled cron job that re-enables password auth temporarily.

UFW blocks your SSH connection after enabling. If you enabled UFW without allowing SSH first, you’ll be locked out. Reconnect via console and run sudo ufw allow 22/tcp (or your custom port).

fail2ban is not banning IPs. Check the jail configuration and logs: sudo tail -f /var/log/fail2ban.log. Ensure the jail is enabled and the log path is correct.

Automatic updates are not running. Check the status with sudo systemctl status unattended-upgrades. Review /etc/apt/apt.conf.d/50unattended-upgrades to ensure the security repository is enabled.

SSH key authentication fails. Verify the public key is in ~/.ssh/authorized_keys on the Pi, with correct permissions (file 600, directory 700). Check that the SSH service is using the right config.

Frequently Asked Questions

Is it safe to expose a Raspberry Pi to the internet at all?

With proper hardening, the risk is manageable, but no internet-facing device is 100% safe. Always keep software updated, use strong authentication, and limit exposure to only necessary ports.

Do I need a static IP for my Pi?

Not necessarily. You can use a dynamic DNS service to map a domain to your changing home IP. For the Pi itself, a static local IP is helpful for port forwarding.

What is the best way to access my Pi remotely?

Using a VPN (like WireGuard) is the most secure method, as it encrypts all traffic and avoids exposing SSH directly. Alternatively, SSH with key-based auth is acceptable if properly configured.

How often should I update my Pi?

Enable automatic security updates and reboot periodically. Check for major updates at least monthly.

Can I use a firewall on the Pi itself?

Yes, UFW is a simple front-end for iptables. It’s a good first line of defense, but also consider your router’s firewall for additional protection.

What should I do if I suspect my Pi is compromised?

Immediately disconnect it from the network, back up important data, and reinstall the operating system. After reinstalling, follow this guide to secure it properly.

Related

• Oracle Data Query: Definition & How SELECT Works
• Planet Zoo 2 Cross Play & Progression Explained
• Nuclear Power Purchase Agreements for Data Centers