secure_raspbery_pi_with_pihole.md

Securing a Raspberry Pi with a public FQDN running pihole

Note, this has been written to run on Raspbian GNU/Linux 10 (buster) but should easily be portable to other Linux distros running on other hardware than the Raspberry Pi.

Change the default user (pi)

Sources:

• https://raspberrytips.com/change-raspberry-pi-username/

Log in to the device using the default user and SSH.

ssh pi@pihole.your_domain.com

Set a password for the root user.

sudo passwd

Edit sshd_config to allow root to login using SSH.

sudo nano /etc/ssh/sshd_config

Make the following edit:

From: #PermitRootLogin prohibit-password
To:   PermitRootLogin yes

Restart SSH for the changes to take effect.

sudo service ssh restart

Now log out the default user and log in as root using SSH.

ssh root@pihole.your_domain.com

Change the name of the default user (pi) to something more secure, i.e. a UUID without any of the dashes. Here, "new_user" is used purely for explanation.

usermod -l new_user pi

Rename the home directory of the new user.

usermod -m -d /home/new_user new_user

Log out as root and back in as new_user.

ssh new_user@pihole.your_domain.com

Now, revoke the root user's SSH login privileges.

sudo nano /etc/ssh/sshd_config

Edit the following line:

From: PermitRootLogin yes
To:   #PermitRootLogin prohibit-password

Restart SSH again for the changes to take effect.

sudo service ssh restart

Enable SSL for the pihole admin webpage

Sources:

• https://discourse.pi-hole.net/t/enabling-https-for-your-pi-hole-web-interface/5771
• https://letsencrypt.org/getting-started/
• https://certbot.eff.org/
• https://pimylifeup.com/raspberry-pi-ssl-lets-encrypt/
• https://eff-certbot.readthedocs.io/en/stable/using.html#renewing-certificates

This will user certbot and let's encrypt to create a free, trusted SSL certificate for your host. First, install certbot.

sudo apt install certbot

If your host has a valid A record of 'pihole.your_domain.com', run the following command:

sudo certbot certonly --webroot -w /var/www/html -d pihole.your_domain.com

If the command was successful, your certificates were created in the '/etc/letsencrypt/live/pihole.your_domain.com/' folder. Combine the private key and the certificate to a combined file, required by the lighttpd web server used by pihole.

sudo cat /etc/letsencrypt/live/pihole.your_domain.com/privkey.pem \
         /etc/letsencrypt/live/pihole.your_domain.com/cert.pem | \
sudo tee /etc/letsencrypt/live/pihole.your_domain.com/combined.pem

Edit the lighttpd's external conf to use this certificate for SSL.

sudo nano /etc/lighttpd/external.conf

Add the following lines:

#Loading openssl
server.modules += ( "mod_openssl" )

setenv.add-environment = ("fqdn" => "true")
$SERVER["socket"] == ":443" {
    ssl.engine  = "enable"
    ssl.pemfile = "/etc/lighttpd/combined.pem"
    ssl.openssl.ssl-conf-cmd = ("MinProtocol" => "TLSv1.3", "Options" => "-ServerPreference")
}

# Redirect HTTP to HTTPS
$HTTP["scheme"] == "http" {
    $HTTP["host"] == "pihole.your_domain.com" {
        url.redirect = (".*" => "https://%0$0")
    }
}

Restart the lighttpd web server.

sudo /etc/init.d/lighttpd restart

Automatically Renew the Certificate

Edit the renewal config file for your certificate to automatically merge these files whenever the certificate is renewed and restart the web server.

sudo nano /etc/letsencrypt/renewal/pihole.your_domain.com.conf

Add the following to the end of the file:

renew_hook = cat $RENEWED_LINEAGE/privkey.pem $RENEWED_LINEAGE/cert.pem > $RENEWED_LINEAGE/combined.pem; systemctl try-reload-or-restart lighttpd

Manually Renew the Certificate

To manually run the renewal, create a post-run script file:

nano ~/certbot-deploy-hook-script.sh

Add the following to the file:

#!/bin/bash
cat /etc/letsencrypt/live/pihole.your_domain.com/privkey.pem \
    /etc/letsencrypt/live/pihole.your_domain.com/cert.pem | \
tee /etc/letsencrypt/live/pihole.your_domain.com/combined.pem
systemctl try-reload-or-restart lighttpd

Make the file executable.

chmod +x ~/certbot-deploy-hook-script.sh

Then run the following command to renew the script, concatenate the PEM files and restart the server.

sudo certbot renew --deploy-hook /usr/new_user/bin/certbot-deploy-hook-script.sh

Note that this will not do anything if the certificate is still valid.

This command can be run as part of cron job or regular updates.

I use a bash script to update the entire system regularly:

#!/bin/bash
sudo apt update | sudo apt upgrade -y
sudo apt autoremove -y
sudo certbot renew --deploy-hook /home/new_user/bin/certbot-deploy-hook-script.sh
pihole -up

Forward visitors of the root website of your pihole to another webiste

In the root folder of the web server's published sites '/var/www/html', add an 'index.html' file with the following content:

<!DOCTYPE html>
<html>

<head>
  <title>Redirecting to Google</title>
  <!-- Redirecting to google.com  using meta tag -->
  <meta http-equiv="refresh" content="0; url=https://google.com" />
</head>

</html>

This will forward users that hit your pihole 'https://pihole.your_domain.com' to Google. The admin interface at 'https://pihole.your_domain.com/admin' is still reachable to you.

Set a strong password for the pihole admin interface

Sources:

• https://discourse.pi-hole.net/t/how-do-i-set-or-reset-the-web-interface-password/1328

This has to be done using a bash command:

pihole -a -p

Select a strong passord, i.e. a UUID. Sample, online random UUIDs generator: https://www.uuidgenerator.net/