Skip to main content

Improving Security

This document describes a few steps for enhancing the security of your TAPPER.

SSH with public-key authentication only​

This allows for a safer and faster login.

Procedure​

  • Before flashing your Raspberry Pi with RPi Imager, go to the OS Customization and turn on SSH with public-key authentication only.
    • An EdDSA (Ed25519) SSH key is recommended
      • If you don't have an SSH key you could use, make a new one with ssh-keygen -t ed25519

MQTT with TLS​

MQTT can work using TLS. This is recommended as it prevents eavesdropping and unauthorized requests.

Procedure​

The entire TLS Setup is described in MQTT TLS Setup.

Wi-Fi passphrase as a hash instead of clear text​

The Wi-Fi passphrase in the config file can be the hash (psk) generated by wpa_passphrase.

Procedure​

  • In your terminal, type wpa_passphrase <SSID> <PASSPHRASE>
    • Example:
    $ wpa_passphrase "ExampleSSID" "ExamplePassphrase"
    network={
            ssid="ExampleSSID"
            #psk="ExamplePassphrase"
            psk=e8aecc0d08936c19af0f377de39a2412c5025fce8d8140b122c33dc346ae3b10
    }
  • Copy the psk and put it into your config:
    • Example:
    wifi:
      network: "ExampleSSID"
      passphrase: "e8aecc0d08936c19af0f377de39a2412c5025fce8d8140b122c33dc346ae3b10"
    ...