Raspberry Pi Server Hardening Checklist
Eighteen checks, in the order I’d do them on a fresh Pi. Free.
Free: Raspberry Pi Server Hardening Checklist
Eighteen checks for locking down a Raspberry Pi server — keys-only SSH, mesh VPN instead of port forwarding, scoped firewall rules, and the grep that catches an API key before you push it.
- Every check runs on my own Pi — nothing theoretical
- Exact commands, and why each one matters
- Free. One email, then the occasional new build.
No spam, unsubscribe in one click. I never share or sell your address.
What’s in it
The Pi under my desk runs thirteen services and is reachable from my phone anywhere in the world, with no ports forwarded. This is exactly how it’s set up — the same commands, in the same order.
- The five that actually matter — keys-only SSH, mesh VPN instead of port forwarding, default-deny firewall, keeping secrets out of git, automatic security updates
- Accounts and permissions — killing the default
piuser, running services as a normal user, scoping passwordless sudo to one command - Network surface — what’s listening, what to switch off, the router settings people forget
- Data and recovery — backups you’ve actually restored, SSD over SD card, thermal headroom
Written from a working system, not a tutorial round-up.