Setting up an headless Raspberry PI

This post describes my steps how to setup an old Raspberry Pi 1 B+ with the current RaspbianOS Image.

Usually I use Banana Pi systems to run as my servers. But in my stock I also have an old Raspberry Pi, that just was laying around.

To get something out of it, I decided to set it up as my Database server with MariaDB.

When searching the Armbian site I did not find a version for that old item, so I had to turn to RaspbianOS.

Here are the steps I needed to take:

Download and install the Image

Since a few time the devs have decided to build some tool, named “raspi-imager”. It is available for Windows, Linux and Mac.
It is more or a less a GUI to get the Image onto an SDCard and configure the basic system.
When trying to install the tool on my Linux MINT 19, it failed with a “gcc” version error. Digging into that, I found, that I had to update my Mint to a higher Version. “Really??”

No, not for that. So I had to walk the “hard” way.

First of all download the correct image from the Website https://www.raspberrypi.com/software/operating-systems/

I could not find a real CLI version, so I downloaded “Raspberry Pi OS with desktop” in version “Release date: September 22nd 2022”:
2022-09-22-raspios-bullseye-armhf.img.xz

Next You need to unpack it, where you need the tool “unxz” for:

unxz 2022-09-22-raspios-bullseye-armhf.img.xz

It creates a file “2022-09-22-raspios-bullseye-armhf.img” and removes the source file -other than tar or gunzip, which leave the source file untouched.

The next steps is to get the image onto the sd card -in my case “/dev/sdb”

sudo dd if=2022-09-22-raspios-bullseye-armhf.img of=/dev/sdb bs=1MB && sync

And now the fun begins.
We have to do two things:

1. enable SSHD and permit root login
2. create a user

To be honest, the second step is a little weired, but according to the manuals, the devs have decided not to enable any user on the system to prevent being hacked at the first boot -reasonable if you think closely.

Ok, let’s go for

Enable SSHD

To get SSHD enabled on boot you need to create an empty file named “ssh” on the “boot” partition.
Be aware, not the folder “boot” in the rootfs partition. This file will be deleted after the first boot.

Now open the file “/etc/ssh/sshd_config” on the “rootfs” partition and change the line

PermitRootLogin ....

to

PermitRootLogin yes

and save it.

Create initial (root) user

There is a user “pi” embedded in the system, but I really don’t get the point, for what, if we have to create a new user by default. So I walk the usual way and create a user named “root” -evil I am….

You need to create a file “userconf” on the “boot” partition -right where we created the “ssh” file, and add a line like so:

root:[encrypted-password]
or better:
root:AWeiredStringOfCharacters

To get an encrypted password you need “openssl”:

echo 'mypassword' | openssl passwd -6 -stdin

You get a long string of random characters, presenting the result of encrypting the password.
Just as a note: This cryptic string is not reversible to get the password. To be simple, you have to type the correct password to the login, so that the algorithm results in the same encrypted key to match.

Now everything is in place. Put the SD Card into the slot of the Raspberry and do

the first boot

Whatever environment you are in, you need to find the first IP adress, the system gets on boot by your DHCP server. User NMAP or check the logs of it to get the address.
If you have a working DNS environment, you should also be able to connect using the name “raspberrypi”:

ssh root@raspberrypi
The authenticity of host 'raspberrypi (10.10.10.235)' can't be established.
ECDSA key fingerprint is SHA256:abcdefghijklmnopqrstuvwxyz.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'raspberrypi,10.10.10.235' (ECDSA) to the list of known hosts.
Please note that SSH may not work until a valid user has been set up.
See http://rptl.io/newuser for details.
root@raspberrypi's password:

Now you need to pre-configure the system. Use raspi-config to do so, and walk through the steps as your needs require.

Remove desktop components

apt purge xserver* lightdm* raspberrypi-ui-mods

After this, reboot the system, because we need to unload the user rpi-first-boot-wizard, that is currently waiting at the GUI to configure the system.
After the reboot we can now remove the unneeded users:

userdel -r rpi-first-boot-wizard
userdel -r pi

And clean up the apt system:

apt autoremove

Now vice versa to update the rest of the system:

apt update && apt upgrade

Create regular user

Nevertheless we need a user to protect “root” from being exposed. So we create one:

useradd -m dummy
usermod -aG sudo dummy
passwd dummy

Now exit the system and try to login with the new user.
If this succeeds we can remove the root login from sshd again.
change console to root by “sudo -i” or use “sudo” prefix for the next steps.
Open /etc/ssh/sshd_config and change
PermitRootLogin yes
to
PermitRootLogin no
and restart the sshd service
service sshd restart
Exit the system and check if login works. If anything went wrong, put the sd card in your pc and change sshd_config back.

I am not a fan of “network-Manager” and all this fancy new stuff, so lets go back to “ifup/down” defaults:

remove Network Manager

It might be, that “network-manager” is not enabled on your system. So adopt those steps to your needs.

apt install ifupdown  
service network-manager stop
update-rc.d NetworkManager remove
apt-get --purge remove network-manager

Now open /etc/network/interfaces and configure, as you need:

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
address 10.10.10.244
netmask 255.255.255.224
gateway 10.10.10.254
broadcast 10.10.10.255
dns-nameservers 10.10.10.242

Reboot the machine and connect using the new IP address, or update your DNS and connect using the hostname/FQDN.

You might run into an error message on login:

rfkill: cannot open /dev/rfkill: Permission denied
rfkill: cannot read /dev/rfkill: Bad file descriptor

I found an hint, that it is related to some WIFI check and this modification solves it:

sudo sed -i '2i\ \ \ \ \ \ \ \ exit 0' /etc/profile.d/wifi-check.sh

After that, the error does not occour anymore.
Usually I now add some management stuff:

apt-get install whois iftop nmap tcpdump

At this point the common setup is finished. Enjoy.