[SECURITY] Pi hardening: firewall, fail2ban, SSH keys

[farcomiot]

🛡️ Raspberry Pi Security Hardening

Parent: #1

Current State

• Password-based SSH authentication
• No firewall configured
• No brute-force protection
• Default user enviropi with known password

Tasks

• Enable UFW firewall (allow SSH 22, deny all inbound)
• Install and configure fail2ban for SSH
• Generate SSH key pair and disable password auth
• Change default user password
• Disable root SSH login
• Set up automatic security updates (unattended-upgrades)
• Configure logwatch for daily security summaries
• Restrict GPIO/serial access to service user only

UFW Rules

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw enable

fail2ban Config

[sshd]
enabled = true
port = ssh
filter = sshd
maxretry = 5
bantime = 3600

---

Ref: #1 Roadmap — Security & Infrastructure