9

The Setup:

I have a Raspberry Pi as the master node which is connected to the internet through a broadband connection, the raspberry pi connects several sensors and other microcontrollers. The Pi is continuously connected to a server at a Cloud Hosting Provider.

The Questions are:

  • How do I stop unauthorized users from accessing my raspberry Pi?
  • How do I prevent a DDoS attack on the Pi?
  • How and should I go about using DDNS (Dynamic DNS) for accessing my Pi?
  • 1
    Related: Securing small home automation setup. There are some general tips there, which might be of interest. – Aurora0001 May 16 '17 at 14:23
  • 3
    DDNS does not belong in the same question as the other points. You should ask one question per question. – Sean Houlihane May 16 '17 at 15:08
  • Is there no router??? – Xavier J May 16 '17 at 20:19
  • @codenoir There is a netgear router – Shakti Phartiyal May 16 '17 at 20:20
  • One more question. Do you have to access the Pi from outside your home or office network? – Xavier J May 16 '17 at 20:22
10

The question 'Securing small home automation setup' provides a useful reference for general security tips, but there are also some specific steps you should follow to keep your Raspberry Pi secure.

Steve Robillard's answer to a question on Raspberry Pi Stack Exchange outlines some of the specific issues with using a Pi that you can address, such as changing default passwords, using iptables, etc. He also helpfully links to the Securing Debian Manual, which, although very large, is incredibly comprehensive, and covers most major concerns.

Since you'll likely be connecting to the Pi through SSH, consider key-based authentication instead of using a password—a SSH certificate is virtually impossible to guess, even by a determined attacker, unlike a potentially weak password. As noted in the linked article, also take a look at Fail2ban, which will IP block any users who show malicious signs (e.g. incorrect password guesses).

Regarding your DDoS concerns: if someone decides to launch a DDoS attack against your Pi, you stand very little chance. Some attacks can reach up to 665 Gbps, which would be impossible for your Pi to defend against. But, I would pose this question: why would an attacker want to DDoS your Pi? Denying you service would probably not provide much benefit to an attacker, and a lot of IoT devices are instead being hacked to participate in DDoS attacks.

Nevertheless, if you were very paranoid, you could perhaps whitelist devices that your Pi was expected to connect to, and simply drop any other packets with iptables. It's up to you to decide if it's worth the trouble.

Regarding DDNS, I find HowToGeek's guide quite clear—essentially, you need to check your router for a DDNS setting, and configure that. NoIP have screenshots for most major router models. You'd probably have better luck asking this separately (and you may already find an answer on Super User).

  • 1
    If @ShaktiPhartiyal wants to use the Pi to update the DDNS vs the router, I had an issue getting the Pi to do so securely. My post has a walk through linked for setting up DDNS and also contains an answer to securely update it. – Shaulinator May 16 '17 at 18:25
  • @Shaulinator my router does not support ddns for domain providers like namecheap – Shakti Phartiyal May 16 '17 at 20:22
  • @ShaktiPhartiyal, I use dnsdynamic which is free. The post I linked to is making your raspberry pi do the work to support DDNS vs your router, which should work on providers like namecheap as well. – Shaulinator May 16 '17 at 20:24
  • @Shaulinator Thank you for the update will check the same and let you know.. – Shakti Phartiyal May 16 '17 at 20:26
5

Along with Aurora0001's answer if you want protection from dDoS you should opt in for services like Cloudflare. It protects you from dDoS attacks by pointing your DNS records to their servers and securing your Domain / server. DDoS Prevention: Protecting The Origin

  • 3
    Agreed. If you're asking about dDoS, you just need to pay someone to implement protection for you. – Sean Houlihane May 16 '17 at 15:10
  • 1
    @SeanHoulihane The basic plan is for free. – IoT Lover May 16 '17 at 15:10
  • Worth adding that to the answer. – Sean Houlihane May 16 '17 at 15:12
  • @IoTLover thank you for the answer. This along with Aurora0001's answer gives a good enough insight. – Shakti Phartiyal May 16 '17 at 15:34
5

Okay. Given the comments so far, here's how I'd approach it:

  1. Set up DDNS through any competent provider.
  2. Set up OpenVPN on your PI, and route UDP port 1194 (or whatever port you set it up on) from the router to the PI. All external connections to your PI will have to have a properly configured OpenVPN client (you could even use a phone!)
  3. As a secondary measure, secure inbound access on the PI using IPTables. It's a pain in the butt to do by hand, so install Webmin (Debian) to configure it. From here, do a Google search on ways to harden your IPTables configuration against DDOS.

You might prefer some other VPN, but I've used OpenVPN for about 10 years now for its incredible flexibility.

  • Thank you will try out this out for sure, the openVPN concept looks secure. By the way is aws.amazon.com/vpc of any use in my setup ? – Shakti Phartiyal May 17 '17 at 6:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.