Hello everyone, we're back!

So in the past months things intensified at my job and one of the projects I have become project manager for is an attempt to hang up monitoring screens throughout the office. Have a small computer report on today's numbers. Think dashboards with revenue, new deals, security incidents (or lack thereof, proud moment!)

One of the candidates for a small computer to run these screens from is the Raspberry Pi. Some research went into setting it up and securing it, and I would like to share that with you all for this new security Saturday!

You should know that I tested several Linux flavors for the Pi. The two best, candidates were Raspberry Pi OS (the official OS) and Manjaro. Manjaro had a little less options for automating the setup and so my choice fell to be Raspberry Pi OS. Since Raspberry Pi OS starts you out with a passwordless administrator account, we better clean that up and set it up more securely, using a bash script.

First I was going to share a PDF (since that is possible now) with the Bash code in it, but setting that up looked to be way too much effort. Uploading the stuff and making a LaTeX implementation of the code is a pain as well, since it has a lot of same-line commentary. So instead, here is two images.

The first image is a layout of the variables the script will use, and the a pre-run check if the script is run as administrator (root is the Linux way of admin).

The first group of variables (hostname up to timezone) are to setup the Pi for use in our proper contacts (Dutch time, US keyboards, etc...) Then there is some (censored) wifi configuration one-liners to be written to configuration files. The third batch has censored web-addresses that pickup configuration files for the unattended-upgrades package that does the same-ish thing as windows auto-update. Then from the same source we pick up public keys to identify those people that are allowed to manage the Raspberry Pi. We will use these for identification, and not so much encryption (although to my understanding that implicitly also happens). Lastly we pick up the IP address of the Pi, before starting the script with the admin check.

After that (second image) you can pick up most of what is going on from the comment in the files. What I want you to notice is that many things are done by just adding to, or replacing text files. This is still one of the great strengths of Linux. Most config files are human-readable and adding or changing options is that simple.

In the process of the script, we generate new passwords, do some housekeeping on the device settings for quality-of-life improvements, and most notably, we obliterate the open-door setup with the Pi user having auto-login and no password requirement on "sudo" (Linux way of the "run as administrator" option on windows). Instead we create a new user called qt which can de passwordless sudo, but you can only login to the VV user using SSH, and only while having the right private key, belonging to the public key made known to the device in this script. The random password for this user is not at all remembered, and therefor one cannot use the password to login using mouse and keyboard.

This way we can give admin rights to all people managing these devices, without ever having to manage many passwords if the amount of screens increase. Which is pretty neat.

This script has some bugs still right now, but the prospects are amazing.

I know this is a very techie post, but hey, I am proud of the setup :)