Raspberry PI setup

Setup a Raspberry PI with two accounts without NOOBS

Raspberry’s NOOBS is great but you are left out with 1Gb~1.5Gb unusable on a 8Gb SD Card, which is a sizeable chunk. Eventually you want that space back.

Most of the following is pretty standard but it’s meant to be a quick lookup list of things to do to speed up setting up new devices.

Preparation

1. Download Raspbian Jessy Lite.
2. Flash the image with dd directly to the SD card.

On device

1. Connect to the device with a keyboard, HDMI and optionally an ethernet cable.
2. Configure wifi if needed:

   sudo iwlist wlan0 scan
   sudo vi /etc/wpa_supplicant/wpa_supplicant.conf
   sudo ifdown wlan0
   sudo ifup wlan0
   iwconfig
   

3. Update the OS:

   sudo apt-get update
   sudo apt-get upgrade
   sudo apt-get install git ifstat lsof sysstat tmux vim
   

4. Configure a new hostname to rename raspberrypi to a new hostname:

   sudo vi /etc/hostname
   sudo vi /etc/hosts
   

5. Configure the two accounts:
   1. $NEW_ADMIN to replace the pi builtin account:

      sudo adduser $NEW_ADMIN
      for i in $(groups pi | cut -d " " -f 4-); do echo $i; sudo adduser $NEW_ADMIN $i; done
      

   2. $NEW_USER for user level access yet with access to all the pins and USB devices:

      sudo adduser $NEW_USER
      for i in gpio i2c plugdev spi users; do echo $i; sudo adduser $NEW_USER $i; done
      

6. Setup ssh keys:

   sudo -u $NEW_ADMIN -i mkdir '$HOME/.ssh'
   sudo -u $NEW_USER -i mkdir '$HOME/.ssh'
   # scp ~/.ssh/authorized_keys to both accounts.
   

7. Reboot to enable new hostname and groups:

   sudo shutdown -r now
   

8. Delete account pi:

   sudo deluser --remove-home pi
   # Remove pi from sudoers:
   sudo vi /etc/sudoers
   

   1. Personally, I add support to reboot the pi without password:

      $NEW_ADMIN ALL=NOPASSWD:/sbin/shutdown -r now
      $NEW_USER ALL=NOPASSWD:/sbin/shutdown -r now
      

9. Resize the partition if necessary. The following assumes a 8GB SD Card with Jessy Lite image flashed directly to the card:

   df -h
   sudo fdisk /dev/mmcblk0
   p
   d, 2
   n, p, 2, 131072, 15523839
   p
   w
   sudo shutdown -r now
   sudo resize2fs /dev/mmcblk0p2
   

10. Setup script to run on startup. Using systemd now available on Raspbian Jessie:

    sudo -i
    cat > /etc/systemd/system/my_command.service << EOF
    [Unit]
    Description=Command description
    After=network.target
    
    [Service]
    Type=simple
    User=$NEW_USER  <- put your low privileged user account here.
    Restart=always
    RestartSec=10
    ExecStart=<command> <- put your command there.
    
    [Install]
    WantedBy=multi-user.target
    EOF
    systemctl daemon-reload
    systemctl enable my_command.service
    systemctl start my_command.service
    systemctl status
    

It is better than other mechanism (like abusing /etc/rc.local) since systemd handles automatic restart on failure and you can manage the task via systemctl.

Things to explore:

• Full Disk Encryption (FDE).
  • References: https://paxswill.com/blog/2013/11/04/encrypted-raspberry-pi/ and my post Remote LUKS unlock.
  • Main concern is I/O performance. I would expect a ~50% slow down.
• Alternative is to use eCryptfs only for the admin account. For an odd reason, this forces installing a lot of libraries, including GTK, which is undesired (TODO: Figure out how to trim this):

  sudo apt-get install ecryptfs-utils
  

  • Then follow up https://help.ubuntu.com/community/EncryptedPrivateDirectory

Updates:

2016-01-29: Change /etc/rc.local setup to systemd mechanism.