Raspberry Pi as a server: SSH, static IP and security

Once your Raspberry Pi is running, you want it to always be found in the same place and ensure nobody can just access it. These are the steps to set it up as a reliable server.

A static IP address

A server must always have the same address, otherwise you won’t be able to find it. There are two ways:

The easiest: a reservation in your router. Look in your router for “DHCP reservation” or “static IP address” and link the address to the MAC address of your Pi. The Pi itself doesn’t need to know anything then.
Configure on the Pi itself. Recent versions of Raspberry Pi OS use NetworkManager. First check what your connection is called, and modify it (replace name and addresses with yours):
```
nmcli connection show
sudo nmcli connection modify "Wired connection 1" ipv4.method manual ipv4.addresses 192.168.1.30/24 ipv4.gateway 192.168.1.1 ipv4.dns 192.168.1.1
sudo nmcli connection up "Wired connection 1"
```
Choose an address outside the range that your router hands out itself. Your connection may drop briefly after this command.

Logging in with a key instead of a password

An SSH key is more secure than a password. Create one on your own computer (Mac, Linux or PowerShell on Windows):

ssh-keygen -t ed25519

Then put the public key on the Pi (Mac and Linux):

ssh-copy-id user@pi.local

Test that logging in now works without a password. Only then disable password login, in a separate file:

echo "PasswordAuthentication no" | sudo tee /etc/ssh/sshd_config.d/10-geen-wachtwoord.conf
sudo systemctl restart ssh

Keep a second terminal open while testing this, so you don’t get locked out.

A firewall

sudo apt install ufw
sudo ufw allow OpenSSH
sudo ufw enable

Add rules later for what you install, for example sudo ufw allow 80/tcp for a web server. See our port list for the common ports.

Automatic security updates

sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

Choose Yes. Security updates will then be installed automatically. Additionally, do a regular update once a month with sudo apt update && sudo apt full-upgrade.

Booting from an SSD

An SD card wears out if you write to it a lot. A USB SSD is faster and more reliable. Choose the SSD as storage in Raspberry Pi Imager and put the operating system directly on it. A Raspberry Pi 5 boots from USB by default; with a Pi 4, the boot order sometimes needs to be adjusted via sudo raspi-config (Advanced Options → Boot Order). With an additional hat, a Pi 5 can also boot from an NVMe SSD.

What do you put on it?

Programs in containers: read Installing Docker and Docker Compose.
Pi-hole to block ads across your entire network.
Share files with Samba, with a USB drive attached.
Put your valuable data in a backup.