Go Headless with Your Raspberry Pi

WE’VE TALKED MANY TIMES about the Raspberry Pi, and in just about every one of our Pi explorations we’ve mentioned the possibility of running it headlessly. This means, as the word “headless” obliquely suggests, cutting off the machine’s face, and disabling most of its senses—disconnecting the monitor, keyboard, and mouse, and running the Pi entirely as a network-attached device. This isn’t as mad as it may sound. The Pi can play many roles, from NAS to network administration to web hosting and beyond, that have no need for any attached peripherals. And, let’s face it, while the Raspbian desktop is functional, running graphical apps does not play to the Pi’s strengths.

So, let’s break down what you need to do to make any Pi capable of running headlessly, and the methods you then need to use to connect to and administer that box through a Windows machine. For the full effect, you need to start with peripherals attached to your Pi, but they won’t be hooked up for long; if you don’t have spares, borrow your regular USB mouse and keyboard. 1 INSTALL RASPBIAN If you already have an existing Raspbian installation working with your Raspberry Pi, you can skip this step, and if you’re already using something different—such as Arch or RiscOS—your methodology is going to be slightly different, though the principle remains the same. Grab a clean Raspbian Stretch disk image from www.raspberrypi.org/downloads/raspbian, then download Etcher from https://etcher.io. The latter is a new disk image writer on the scene, but it’s about as foolproof as these things get. Once you have it up and running, click “Select image,” and pick your Raspbian file, click “Select drive,” and pick your SD drive, then click “Flash” to unite the two [ Image A].

2 HEADS UP With everything safely installed, hook up your Pi to your peripherals and monitor, then to your router, using an Ethernet cable if possible [ Image B]. Power it up. A new Raspbian install automatically runs a console application called raspi-config; if you have an existing install, just drop to the text terminal (from the desktop, hit Ctrl-Alt-F1), and run raspi-config to get there manually. Head to “Interface options/SSH,” and switch on SSH, which stands for Secure Socket Shell. This is the protocol we’ll use to communicate with the Pi’s terminal over the network. Exit raspi-config, and (still in the console) run ifconfig eth0 to get the IP address of the Raspberry Pi.

3 MAKE IT STATIC If your Pi or your router get rebooted, the IP address you just discovered might change—that’s not ideal, considering that we’re looking to access it via the network. So, let’s lock it down. Type sudo nano /etc/dhcpcd.conf to tweak the appropriate Raspbian config file (the default su password is “raspberry” when you’re asked), and head to the bottom of the file. Add the following, replacing the static address with that of your Pi (leaving the “/24” part at the end), and the others with that of your router:

interface eth0 static ip_address=192.168.0.100/24 static routers=192.168.0.1 static domain_name_servers=192.168.0.1

>> If you’re connecting with Wi-Fi, rather than good old RJ45, you can safely replace “eth0” with “wlan0”—or even, if you like, apply a static address to both networks by duplicating the same chunk of text. When you’re finished, exit Nano with Ctrl-X, and hit Y when prompted to save the changes to the file.

4 A QUICK TEST Type sudo reboot to reinitialize Raspbian with these new settings, and check that they’ve sunk in by once again running ifconfig eth0 , and ensuring that the IP address is as you’d expect. Run sudo service ssh status to check that your SSH server is up and running, and you should be good to go. Now jump on your Windows machine, head to www.putty.org, and download the relevant PuTTY installer for your system. Install it with the default options, and run PuTTY. Add your Pi’s local IP address in the “Host Name” box at the top of the window [ Image C], and click “Open.” You should connect directly to your Pi’s command line terminal. If so, feel free to disconnect your peripherals and reboot—you’re now running headless.

5 KEY CUTTING The first “S” in SSH stands for “secure,” but your current connection—to an open Raspberry Pi with the default password—is far from it. The first course of action is, naturally, to change that default Pi password by running passwd pi in the terminal. Now, on your Windows machine, run PuTTYgen [ Image D] to begin the process of creating a secure key pair. Leave the options at the defaults, click “Generate,” and wiggle your mouse over the blank area. Type a long passphrase to protect your private key—this will be the password you use to log in, going forward—then click “Save private key” to generate a secure .ppk file, and “Save public key” to create a plain text file containing the public key. Put these somewhere safe.

6 LOCK IT DOWN Open PuTTY, log in to your Pi as normal, and type mkdir ~/.ssh to create a directory to house the public portion of the key, then chmod -R og= ~/.ssh to ensure that only you are allowed to write to and read from that directory. Run sudo nano ~/authorized_keys , then copy and paste the public key from the top of the PuTTYgen window into this file. Save it, and end your PuTTY session for now. Back in the main PuTTY interface, drill down in the left column to “SSH > Auth,” and use the “Browse” button to point it at your .ppk private key [ Image E]. Log in to your Pi again, and you should be asked for the password of the private key—if all has gone well, you can now use Nano to edit the “/etc/ssh/sshd_config” file, and set password authentication to “no.” Reboot, and the only way you’ll be allowed in is by using your private key.