Initial Headless Setup with RPi3B+ OS (Buster)

README.md

Initial Headless Setup with RPi3B+ OS (Buster)

1. Download the latest version of Raspberry Pi OS
   • with the caveat that there was a change to camera utility between buster and bullseye.
   • This was tested on an older Buster image
2. Download the Imager and use it to impact the downloaded zip's .img onto the MicroSD
3. touch ssh in the boot drive's /, to enable one-time ssh if headless
4. ssh -vvv pi@raspberrypi.local when connected by ethernet and powered on. (Which includes approving the ECDSA fingerprint)
5. Enable the ssh server perpetually, rather than the one-time start up.
   • sudo raspi-config, select Interface Options, then select SSH, then confirm with Yes, OK, Finish
6. Change the password. The default user pi with password raspberry can be replaced. Instructions copied from the pi tutorial are (for the example user alice);
   • sudo adduser alice
   • sudo usermod -a -G adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,gpio,i2c,spi alice
   • sudo su - alice to check the sudo group was applied (which might just warn that WiFi is not yet enabled.)
   • sudo raspi-config, select System Options, then Boot / Auto Login
     • Console Autologin to change from pi to alice
     • OR Console to require a password
     • (which will trigger a request to reboot, that you should accept).
   • because some RPi's require the pi user, rather than delete, just passwd to change.
   • To make sudo require a password every time on the pi user;
     • sudo visudo /etc/sudoers.d/010_pi-nopasswd (which will open nano. gross)
     • swap pi ALL=(ALL) NOPASSWD: ALL to pi ALL=(ALL) PASSWD: ALL (Ctrl+O and write to the *.tmp file, then Ctrl+X to exit)
     • There is not one by default made for the new user, and the default behaviour is PASSWD: ALL anyway.
   • There's plenty more security considerations available, but not relevant immediately during an example setup.
7. Add the wifi network to wpa_supplicant.conf and sudo reboot
   • This can either be done after imaging the MicroSD, before loading the first time, or can be edited in the file /etc/wpa_supplicant/wpa_supplicant.conf, or done with raspi-config
   • To directly edit the file, use sudo iwlist wlan0 scan to get the *ssid of networks available and add the WPA/WPA2 network you want.
     • It's possible sudo iwlist wlan0 scan will yield wlan0 Interface doesn't support scanning : Network is down
     • In which case, use sudo ifconfig wlan0 up, and perhaps get SIOCSIFFLAGS: Operation not possible due to RF-kill
     • If so, sudo rfkill list will show that Wireless LAN is soft blocked. Unblock it with sudo rfkill unblock wifi
     • Scanning again should automatically start and yield a list of cells.
       • Look for the cell with the ESSID you want to join, and confirm its "IE: IEEE 802.11i/*" is of WPA/WPA2, and provides PSK in "Authentication Suites"
   • While we could just enter the password raw, it's better to use wpa_passphrase to generate an encrypted psk
     • wpa_passphrase "*ssid", then enter the password. This'll give you the encrypted PSK
     • Open wpa_supplicant sudo nano /etc/wpa_supplicant/wpa_supplicant.conf, copy the output of wpa_passphrase ~ and remove the unencrypted password.
   • Also set the country code, by adding a country=<country_code> line in wpa_supplicant.conf
   • It should now look something like;

     ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
     update_config=1
     country=AU
     
     network={
         ssid="Some_Network_Name"
         psk=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
     }
     

   • Once finished editing, wpa_cli -i wlan0 reconfigure to immediately pick up the changes, then ifconfig wlan0 to check, and see an inet address.
8. You should now be able to disconnect from ethernet and connect over WiFi, assuming you've set up on the same network
   • ssh -vvv <pi|alice>@raspberrypi.local should continue to work locally without having changed the hostname in raspi-config, or alternatively use the local IP if ssh'ing from windows.
9. Update ~ sudo apt update && apt upgrade && apt dist-upgrade
   • Depending on your release version, might get a warning about deprecation of NPAPI from webkit2gtk after the upgrade has completed.
   • Install a good, non-nano, editor; sudo apt install vim
   • Install all the good things sudo apt install build-essential
   • pip install --upgrade pip and pip3 install --upgrade pip
10. Setup remote client (VNC installed by default, but must be enabled with raspi-config) as well as installing the remote server locally. Make sure you've picked a reasonable default HDMI/DVI, as this impacts the resolution of VNC.
    • sudo raspi-config, select Interface Options, then select VNC, then confirm with Yes, OK, Finish
    • Connect from the VNC Viewer locally, and start the GUI from cli with sudo startx
    • On the first connection, it'll ask you to set your country, language, and timezone.
    • It will also run through some of the other "first time startup" questions that have already been handled by the above and can be ignored.
    • If you'd like to connect with VNC without SSH in the future, got back into Boot / Auto Login and set it to Desktop Autologin
    • To change the resolution in headless mode, in sudo raspi-config, go to Display Options, Resolution, and select an appropriate resolution, and accept the reboot.