1. Headless set-up
1.1. Intro
Every time I deploy a new pi, something has changed. This makes it difficult to create a simple set-up that works every time. It also means that almost all instructions you find on the internet are outdated. Google is great in finding set-up instructions from back in 2012, but those do not work anymore. And most instructions do not have a date in them, so you're completely lost why it doesn't work.
This instruction is made for people that have Linux running. It is updated after each time I (re-)install a Pi.
Version
|
Date
|
Raspian
|
Comment
|
1
|
2017-06-21
|
Jessie
|
|
2
|
2017-12-29
|
2017-11-29-raspbian-stretch
|
|
3
|
2017-12-29
|
2017-11-29-raspbian-stretch
|
|
4
|
2019-01-19
|
2018-11-13-raspbian-stretch.img
|
|
5
|
2020-03-18
|
2020-02-13-raspbian-buster
|
|
6
|
2021-02-23
|
2020-02-13-raspbian-buster.img
|
installed psi
|
7
|
2021-08-12
|
2020-02-13-raspbian-buster.img
|
installed blueberry
|
1.2. Burning the image
First get the latest Raspian:
wget http://downloads.raspberrypi.org/raspbian_latest
What you'll get is a zip-file with the latest raspian-image. Unzip and burn on the SD-card.
Many tutorials go into great length on how to identify your SD-card. In most cases, it is /dev/mmcblk0 or one of the /dev/sd* devices.
mv raspbian_latest raspbian_latest.zip unzip raspbian_latest.zip sudo dd if=2020-02-13-raspbian-buster.img of=/dev/mmcblk0 status=progress
Of course, this takes a long time; that is why the status=progress is on the command line. Total is about 3.6G.
Remove the card and plug it back in. Normally, it will be mounted automatically, and you will see:
/dev/mmcblk0p1 on /run/media/ljm/boot type vfat /dev/mmcblk0p2 on /run/media/ljm/5c01c1ce-fe60-428a-8e68-0be0e8ed6b7a type ext4
Otherwise, mount by hand.
For raspian-stretch and buster, the root file system will be called rootfs instead of the big number.
1.3. The networking
Because from Jessie on, it is now using systemd, everything you knew about the configuration of networking is now of no value. In previous releases, networking was done via /etc/network/interfaces but now, dhcpcd is used. It also means that all tutorials and howto's are now obsolete.
The main configuration file for dhcpcd is /etc/dhcpcd.conf. For every connection that you want to have a fixed IP address add a block, of course with your own IP addresses:
interface eth0 static ip_address=192.168.178.53/24 static routers=192.168.178.1 static domain_name_servers=192.168.178.6 interface wlan0 static ip_address=192.168.178.3/24 static routers=192.168.178.1 static domain_name_servers=192.168.178.6
For some dark and unknown reason, you sometimes need to edit /etc/network/interfaces to add
allow-hotplug eth0
Next, setup the wpa-supplicant in etc/wpa_supplicant/wpa_supplicant.conf
country=GB ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev update_config=1 network={ ssid="ssidforwifi" psk="wifipsk" }
You will need to copy the wpa_supplicant.conf file for your particular wireless network in the boot folder, and when the Pi first boots, it will copy that file into the correct location in the Linux root file system and use those settings to start up wireless networking. After the Pi is connected to power, make sure to wait a few (up to 5) minutes for it to boot up and register on the network. The Pi's IP address will not be visible immediately after power on, so this step is crucial to connect to it headlessly. Depending on the OS and editor you are creating this on, the file could have incorrect newlines or the wrong file extension so make sure you use an editor that accounts for this.
1.4. Enable ssh
Enabling ssh requires an ssh file in the boot directory. Normally, you see a directory
/dev/mmcblk0p1 /run/media/username/boot
if you query all mounts. So do a
touch /run/media/username/boot/ssh
and ssh will start at boot-time.
But you don't want to type passwords, so we'll distribute the keys:
cd $piroot/root mkdir .ssh chown root.root .ssh chmod 700 .ssh cp ~/.ssh/id_rsa.pub .ssh/authorized_keys chmod 600 .ssh/authorized_keys
1.5. Connecting and manual actions.
If you do it in this way, everything should run and the pi should be accessible under your WiFi IP address.
Try a ssh root@192.168.178.3 (use your own IP address) and voila.
There are some manual actions to take before everything works. First, make your users that need to be present on the system. In my case, that is "ljm":
adduser ljm mkdir /home/ljm cp -r /root/.ssh ~ljm chown -R ljm.ljm ~ljm/.ssh
Next item on the list: raspi-config. Use the menus to set the host name. But more importantly, under 7 Advanced Options you will find A1 Expand File system which will allow you to use the complete sd card.
Under Buster, you will need to set under
4 Localisation Options
the Wifi country
I4 Change Wi-fi Country
Do not reboot after this!
Make vi our default editor:
update-alternatives --set editor /usr/bin/vim.tiny
you will also need to add the users in the sudoers-file:
ljm ALL=(ALL:ALL) NOPASSWD: ALL
If you want to manage your pi via Ansible, you may want to
sudo apt-get install -y aptitude
And to be up-to-date, do:
apt-get update apt-get upgrade
This may take a very long time. You will may see a lot of lines
Removing 'diversion of /boot/bootcode.bin to /usr/share/rpikernelhack/bootcode.bin by rpikernelhack'
Removing 'diversion of /boot/start4.elf to /usr/share/rpikernelhack/start4.elf by rpikernelhack'
Removing 'diversion of /boot/start4cd.elf to /usr/share/rpikernelhack/start4cd.elf by rpikernelhack'
Removing 'diversion of /boot/start4db.elf to /usr/share/rpikernelhack/start4db.elf by rpikernelhack'
Removing 'diversion of /boot/start4x.elf to /usr/share/rpikernelhack/start4x.elf by rpikernelhack'
which take a while to complete. When I did this, it took about two hours.
And now: reboot
1.6. Security
With this set-up you can add the pi to your local network. Not to the Internet. There are a lot of security implications that we have not considered. One of the most important is that the user pi is still present and having his default password. Also the NOPASSWD in the sudoers is practical, but a bad idea security-wise.
The goal of this part was to get the pi working; not to make it secure.
1.7. note
Raspberry Pi is a trademark of the Raspberry Pi Foundation.