lock down every raspberry pi before first boot

that raspberry pi in your drawer is probably still running default creds

you know the one. you bought it for a project two years ago, flashed raspbian, got distracted, and now it's either sitting in a drawer or it's been running headless on your network ever since with whatever settings came out of the box. bots scanning the internet do not care that it's "just a pi." they care that it's a device with a known default password and an open port. five minutes of setup before first boot is the difference between a fun little linux box and the weakest link on your network.

step one: change the password immediately

default credentials are the single most common way small linux devices get popped. raspberry pi os used to ship with pi/raspberry as the login, and even though newer installer versions force you to set a password during imaging, there are still a ridiculous number of pis out there running the old default. bots don't guess, they just try known defaults against every ssh port they find. don't give them the win.

passwd

change it to something long and unique, not a word, not your dog's name plus a number. if you're setting up multiple pis, use a password manager and give each one its own credential. reusing one password across a fleet of iot devices means one compromise is every compromise.

step two: kill bluetooth if you're not using it

every radio you leave on is attack surface you don't need. if your project isn't using bluetooth, turn it off at the kernel level instead of just hoping nothing talks to it.

rfkill block bluetooth

this is a soft block that disables the radio without you having to physically remove hardware or mess with config files. check what's blocked with rfkill list. if you genuinely need bluetooth for the project, skip this step, but don't leave radios running by default just because the board shipped with them on.

step three: shut avahi up

avahi is the service that makes your pi show up as "raspberrypi.local" on the network using zeroconf/mdns. convenient for finding your pi, also convenient for anyone else scanning the network who wants to know "hey, what's running raspberry pi os here." it's a tiny fingerprint but it's a free one, and free recon for an attacker is something you can just remove.

sudo systemctl disable --now avahi-daemon

if you rely on the .local hostname to ssh in from your laptop, you'll need to switch to using the pi's static ip instead. that's a trade worth making, especially if this pi is going to live outside your home network or in a more exposed spot.

step four: check what's actually listening with ss -tlnp

this is the one command that tells you the truth about your box instead of what you assume is running.

ss -tlnp

breaking down the flags: -t shows tcp sockets, -l shows only listening sockets (services waiting for connections, not active ones), -n shows numeric ports instead of resolving service names, which is faster and avoids dns lookups, and -p shows the process name and pid attached to each listening port.

on a freshly hardened pi, you should basically see ssh on port 22 and not much else. if you see something listening that you didn't install or configure yourself, like an open web server, a database port, or a service you forgot you enabled, that's your signal to investigate. either you need it and should firewall it properly, or you don't need it and should kill it:

sudo systemctl stop servicename
sudo systemctl disable servicename

run this command on every device you own, not just pis. it takes five seconds and tells you more about your actual exposure than any scanner you could pay for.

step five: apt full-upgrade

sd card images sit on shelves for months before you buy them. the os you just flashed could be carrying known, patched vulnerabilities from the day it was built. update before you do anything else with the device.

sudo apt update && sudo apt full-upgrade -y

full-upgrade (as opposed to plain upgrade) will also handle dependency changes and remove obsolete packages when needed, which matters more on raspberry pi os than people expect.

the takeaway

none of this is advanced. it's five boring steps that take less time than unboxing the pi did. change the default password, kill radios and services you're not using, check what's actually listening with ss -tlnp, and patch before you do anything fun with the board. do this before first boot, every time, for every device, and your homelab stops being the easy target on your network. send this to whoever in your life has a pi running untouched in a drawer somewhere. they'll thank you later, probably after they check ss -tlnp and see something they didn't expect.