The annotations in the preceding screenshot of Win32 Disk Imager correspond to the previous step numbers

Once you have installed the Raspbian OS to the SD card, insert the SD card into Raspberry Pi and connect the keyboard, mouse, and LCD screen using the HDMI port and power the Raspberry Pi. On the first run, it will ask for your username and to type pi and the password as raspberry when prompted. Now, type startx to load the familiar UI.

Now, connect the Ethernet cable to your Raspberry Pi.

If you are using Raspbian, this can be done by choosing the Expand Filesystem option within the raspi-config script, which executes on the first boot. However, you can also launch this script manually by running sudo raspi-config. If your distribution does not provide an automated way to expand the filesystem and you do not have GParted available on your PC, this can be done on the Raspberry Pi itself. For this example, a card containing the Arch Linux image is resized by following these steps:

The NetInstall has distributed an image, as it is simpler for Linux users. The following steps help in preparing the NetInstall on Linux:

Download and extract http://hifi.iki.fi/raspbian-ua-netinst/raspbian-ua-netinst-latest.zip onto a FAT32 formatted SD card, as shown in the NOOBS install steps.

The default install does not replace the kernel, customize the install to your locale, or install any of the Raspberry Pi headers and libraries. The following steps provide a more complete install:

If you want to make the Raspberry Pi accessible from outside of the local network, extra precautions should be taken to protect it from bots and hackers. Most bots simply attempt to connect on port 22 as root and brute force the password. Assuming that the password is relatively secure, this isn't a big problem, but it will eventually start filling up the logs with failed login attempts.

Changing the port number and forbidding root login over SSH is the simplest way of stopping the vast majority of automated login attempts. This can be done by editing /etc/ssh/sshd_config and setting the following options:

Port 1286 #Any unused port number is fine
PermitRootLogin no

However, changing the port number is not always desirable and will not stop someone from scanning for open ports. Ideally, you would disable password logins altogether and use keys. This is how it works—you generate a private and public key. The public key can be sent to a remote server. The private key, as the name implies, is kept private and is used instead of the password.

Windows users can generate the keys using the PuTTYgen tool, which is available on the PuTTY website:

Open the configuration file to edit with Sudo nano /etc/fail2ban/jail.local and paste the following content (assuming your private IP addresses are in the range 192.168.0.*):

# SSH
# 3 failed retry: Ban for 10 minutes
[ssh]
enabled = true
port = ssh
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
mail-whois-lines[name=%(__name__)s, dest=%(destemail)s, logpath=%(logpath)s]
logpath = /var/log/auth.log
maxretry = 3
bantime = 600
ignoreip = 192.168.0.0/10

[ssh-ddos]
enabled = true
port = ssh
filter = sshd-ddos
action = iptables[name=SSH, port=ssh, protocol=tcp]
logpath = /var/log/auth.log
maxretry = 10
ignoreip = 192.168.0.0/10

Restart the fail2ban service:

sudo /etc/init.d/fail2ban restart

Besides executing commands remotely, SSH also allows us to transfer files. The scp command is similar to cp, but can copy files to and from SSH servers with the following command:

$ scp /path/to/src user@IP:/path/to/dst

This works great for a simple file transfer, but there is a more powerful command, which is as follows:

$ rsync /path/to/src user@IP:/path/to/dst -av

Rsync will only copy files that differ. By default, it does this by checking the file size and timestamp of the file, but a -c option can also be passed to use a checksum. This is very useful when making backups or updating source code, for example. It can also be used with a local source and destination, making it a very useful tool to get familiar with.

Windows users can use WinSCP, which is available at http://winscp.net. It has an excellent GUI that can use PuTTY private keys, and offers a way to move files between your PC and Raspberry Pi.

So, you can run commands and transfer files, but what about the GUI? The X Windowing System was designed with the ability to use a remote display in mind. SSH can be used to forward remote GUI programs to the local X server. For Linux users, it's only a matter of launching SSH as before, but with the addition of a -Y option. When you have a SSH session ready, try launching leafpad. It should show up on your display.

Windows users will require an X server running. Some options are listed here:

While screen is not related to SSH directly, it is an incredibly powerful combination. Under normal conditions, if our connection drops and the SSH session is lost, everything that was running inside of it is terminated. This may result in a lot of hard work being lost. The screen allows us to create a session, which you can detach and re-attach as required. While detached, everything will continue to run as normal. If the connection drops, you can simply re-attach to the screen session and continue where you left off. Unfortunately, Raspbian does not come with screen preinstalled, so run the following command to install it:

# apt-get install screen

Once installed, it can be launched by running the following command:

# screen

You will receive a welcome screen, which can be dismissed by pressing Enter or disabling it in ~/.screenrc.

First, you'll need to learn a few key bindings to get started with screen. The default key bindings are initiated by pressing Ctrl + a and are completed by another key. For example, the screen session can be detached by pressing Ctrl + a and then d. Once detached, you can return back to the screen session by running the following command:

# screen -x

What if you want to run multiple applications? On a local machine, you have multiple ttyS commands or you can open many terminals windows and tabs. Starting a new SSH session for every application would be a little inconvenient. Screen has us covered here as well. Ctrl + a+ c will create a new window. The first window (0) is now replaced by the new window (1). To return to the first windows, the Ctrl + a + 0 binding will work. You can have as many windows as needed and navigate them using the Ctrl + a + 0-9 keys. Alternatively, Ctrl + a will bring up a list of all windows and let us switch between them using the arrows and the Enter key.

This short introduction only scratches the surface of what is possible with screen. It can display multiple windows at once in a split view, allowing you to have a file browser, a media player, and a network monitor running and making them visible all at once within the screen session. Multiple users can connect to the same screen session, if remote assistance is required. Screen can be configured to display a status bar with all of the windows listed and a clock, for example. It also supports start-up scripts, which can be very useful for power users.

Your Raspberry Pi could be behind a firewall with no access to port forwarding. In such a case, you can't connect directly. However, if the computer you wish to connect from is not behind a firewall and also has an SSH server running, reverse SSH can be used. From the Raspberry Pi, start SSH with the following command:

$ ssh -N -R 2222:localhost:22 user@IP

In this case, the user and IP parameters are for the computer you wish to connect from. -N means that you do not wish to run any commands. -R 2222:localhost:22 means that port 22 on localhost is going to be tunneled to port 2222 on the remote computer.

Then, from the remote computer, you can connect to localhost on port 2222 and that will redirect to port 22 on the Raspberry Pi launching SSH as follows:

$ ssh user@localhost –p 2222

The disadvantage is that this needs to be prepared in advance and will only last as long as both computers are on. This can be circumvented by preparing a script that runs every 15 minutes and creates the tunnel if it's not already established.

The other problem is that one computer must not be behind a firewall. The solution is to use a middleman server, which the Raspberry Pi will establish a tunnel with. Then, you can connect to this server and be tunneled through to the Raspberry Pi. However, the fundamental problem still remains, as now you require yet another server that is not behind a firewall. If such a server is not available, a third-party solution such as Hamachi, may be an option.