Raspberry Pi OSの最新化と、SSHのセキュリティな設定を行い万全な環境を作ります。
Raspberry Pi OSアップデート
パッケージのアップデート
インストールパッケージをアップデート。
$ sudo apt-get -y update
Hit:1 http://deb.debian.org/debian trixie InRelease
Get:2 http://deb.debian.org/debian trixie-updates InRelease [47.3 kB]
Hit:3 http://deb.debian.org/debian-security trixie-security InRelease
Hit:4 http://archive.raspberrypi.com/debian trixie InRelease
Fetched 47.3 kB in 1s (49.8 kB/s)
Reading package lists... Done$ sudo apt-get -y dist-upgrade
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
The following packages will be upgraded:
libdtovl0 libgpiolib0 libpisp-common libpisp1 librpieepromab0 librpifwcrypto0 libssh2-1t64 python3-urllib3 raspi-utils raspi-utils-core raspi-utils-dt raspi-utils-eeprom raspi-utils-otp raspinfo rpi-eeprom rpi-loop-utils rpi-swap
rpieepromab rpifwcrypto
19 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 3,670 kB of archives.
After this operation, 2,168 kB of additional disk space will be used.
Get:1 http://deb.debian.org/debian-security trixie-security/main arm64 libssh2-1t64 arm64 1.11.1-1+deb13u1 [236 kB]
Get:2 http://deb.debian.org/debian-security trixie-security/main arm64 python3-urllib3 all 2.3.0-3+deb13u2 [115 kB]
Get:3 http://archive.raspberrypi.com/debian trixie/main arm64 libdtovl0 arm64 20260626-1 [30.0 kB]
Get:4 http://archive.raspberrypi.com/debian trixie/main arm64 libgpiolib0 arm64 20260626-1 [41.0 kB]
Get:5 http://archive.raspberrypi.com/debian trixie/main arm64 libpisp1 arm64 1.6.0-1 [312 kB]
Get:6 http://archive.raspberrypi.com/debian trixie/main arm64 libpisp-common all 1.6.0-1 [8,942 B]
Get:7 http://archive.raspberrypi.com/debian trixie/main arm64 librpieepromab0 arm64 20260626-1 [14.8 kB]
Get:8 http://archive.raspberrypi.com/debian trixie/main arm64 librpifwcrypto0 arm64 20260626-1 [13.8 kB]
Get:9 http://archive.raspberrypi.com/debian trixie/main arm64 raspi-utils-core arm64 20260626-1 [41.4 kB]
Get:10 http://archive.raspberrypi.com/debian trixie/main arm64 raspinfo all 20260626-1 [10.6 kB]
Get:11 http://archive.raspberrypi.com/debian trixie/main arm64 raspi-utils-otp all 20260626-1 [10.3 kB]
Get:12 http://archive.raspberrypi.com/debian trixie/main arm64 raspi-utils-eeprom arm64 20260626-1 [27.6 kB]
Get:13 http://archive.raspberrypi.com/debian trixie/main arm64 raspi-utils-dt arm64 20260626-1 [54.9 kB]
Get:14 http://archive.raspberrypi.com/debian trixie/main arm64 raspi-utils all 20260626-1 [7,794 B]
Get:15 http://archive.raspberrypi.com/debian trixie/main arm64 rpi-eeprom all 28.28-1 [2,691 kB]
Get:16 http://archive.raspberrypi.com/debian trixie/main arm64 rpi-loop-utils all 1.2.3 [7,872 B]
Get:17 http://archive.raspberrypi.com/debian trixie/main arm64 rpi-swap all 1.2.3 [17.1 kB]
Get:18 http://archive.raspberrypi.com/debian trixie/main arm64 rpieepromab arm64 20260626-1 [14.9 kB]
Get:19 http://archive.raspberrypi.com/debian trixie/main arm64 rpifwcrypto arm64 20260626-1 [15.4 kB]
Fetched 3,670 kB in 3s (1,246 kB/s)
apt-listchanges: Reading changelogs...
(Reading database ... 69010 files and directories currently installed.)
Preparing to unpack .../00-libdtovl0_20260626-1_arm64.deb ...
Unpacking libdtovl0:arm64 (20260626-1) over (20260601-1) ...
Preparing to unpack .../01-libgpiolib0_20260626-1_arm64.deb ...
Unpacking libgpiolib0:arm64 (20260626-1) over (20260601-1) ...
Preparing to unpack .../02-libpisp1_1.6.0-1_arm64.deb ...
Unpacking libpisp1:arm64 (1.6.0-1) over (1.5.0-1) ...
Preparing to unpack .../03-libpisp-common_1.6.0-1_all.deb ...
Unpacking libpisp-common (1.6.0-1) over (1.5.0-1) ...
Preparing to unpack .../04-librpieepromab0_20260626-1_arm64.deb ...
Unpacking librpieepromab0:arm64 (20260626-1) over (20260601-1) ...
Preparing to unpack .../05-librpifwcrypto0_20260626-1_arm64.deb ...
Unpacking librpifwcrypto0:arm64 (20260626-1) over (20260601-1) ...
Preparing to unpack .../06-libssh2-1t64_1.11.1-1+deb13u1_arm64.deb ...
Unpacking libssh2-1t64:arm64 (1.11.1-1+deb13u1) over (1.11.1-1) ...
Preparing to unpack .../07-python3-urllib3_2.3.0-3+deb13u2_all.deb ...
Unpacking python3-urllib3 (2.3.0-3+deb13u2) over (2.3.0-3+deb13u1) ...
Preparing to unpack .../08-raspi-utils-core_20260626-1_arm64.deb ...
Unpacking raspi-utils-core (20260626-1) over (20260601-1) ...
Preparing to unpack .../09-raspinfo_20260626-1_all.deb ...
Unpacking raspinfo (20260626-1) over (20260601-1) ...
Preparing to unpack .../10-raspi-utils-otp_20260626-1_all.deb ...
Unpacking raspi-utils-otp (20260626-1) over (20260601-1) ...
Preparing to unpack .../11-raspi-utils-eeprom_20260626-1_arm64.deb ...
Unpacking raspi-utils-eeprom (20260626-1) over (20260601-1) ...
Preparing to unpack .../12-raspi-utils-dt_20260626-1_arm64.deb ...
Unpacking raspi-utils-dt (20260626-1) over (20260601-1) ...
Preparing to unpack .../13-raspi-utils_20260626-1_all.deb ...
Unpacking raspi-utils (20260626-1) over (20260601-1) ...
Preparing to unpack .../14-rpi-eeprom_28.28-1_all.deb ...
Unpacking rpi-eeprom (28.28-1) over (28.27-1) ...
Preparing to unpack .../15-rpi-loop-utils_1.2.3_all.deb ...
Unpacking rpi-loop-utils (1.2.3) over (1.2.2) ...
Preparing to unpack .../16-rpi-swap_1.2.3_all.deb ...
Unpacking rpi-swap (1.2.3) over (1.2.2) ...
Preparing to unpack .../17-rpieepromab_20260626-1_arm64.deb ...
Unpacking rpieepromab (20260626-1) over (20260601-1) ...
Preparing to unpack .../18-rpifwcrypto_20260626-1_arm64.deb ...
Unpacking rpifwcrypto (20260626-1) over (20260601-1) ...
Setting up raspi-utils-eeprom (20260626-1) ...
Setting up raspi-utils-otp (20260626-1) ...
Setting up libdtovl0:arm64 (20260626-1) ...
Setting up raspi-utils-dt (20260626-1) ...
Setting up libpisp-common (1.6.0-1) ...
Setting up libgpiolib0:arm64 (20260626-1) ...
Setting up librpifwcrypto0:arm64 (20260626-1) ...
Setting up python3-urllib3 (2.3.0-3+deb13u2) ...
Setting up libpisp1:arm64 (1.6.0-1) ...
Setting up libssh2-1t64:arm64 (1.11.1-1+deb13u1) ...
Setting up raspi-utils-core (20260626-1) ...
Setting up librpieepromab0:arm64 (20260626-1) ...
Setting up rpi-loop-utils (1.2.3) ...
Setting up raspinfo (20260626-1) ...
Setting up rpieepromab (20260626-1) ...
Setting up rpifwcrypto (20260626-1) ...
Setting up raspi-utils (20260626-1) ...
Setting up rpi-swap (1.2.3) ...
Setting up rpi-eeprom (28.28-1) ...
Processing triggers for man-db (2.13.1-1) ...
Processing triggers for libc-bin (2.41-12+rpt1+deb13u3) ...$ sudo apt-get -y autoremove
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.$ sudo apt-get autoclean
Reading package lists... Done
Building dependency tree... Done
Reading state information... DoneLinuxカーネルのアップデート
途中”y”の入力が必要なので注意ください。
$ sudo rpi-update
*** Raspberry Pi firmware updater by Hexxeh, enhanced by AndrewS and Dom
*** Performing self-update
*** Relaunching after update
*** Raspberry Pi firmware updater by Hexxeh, enhanced by AndrewS and Dom
FW_REV:c13f3fa9f499f4dfabe1ddd24a5b9c90d3580887
BOOTLOADER_REV:aa33b8dc7cee51de4b75580095521dea50407d6e
*** We're running for the first time
*** Backing up files (this will take a few minutes)
*** Backing up firmware
*** Backing up modules 6.18.34+rpt-rpi-2712
WANT_32BIT:0 WANT_64BIT:1 WANT_64BIT_RT:0 WANT_PI4:1 WANT_PI5:1
Updating a system with initramfs configured is not supported by rpi-update.
If your system relies on drivers provided by the initramfs (e.g. custom filesystem options)
it may not boot without regenerating the initramfs.
If you are unsure, test if your system boots with initramfs options disabled from config.txt
Would you like to proceed? (y/N) <==yを入力
##############################################################
WARNING: This update bumps to rpi-6.18.y linux tree
See discussions at:
https://forums.raspberrypi.com/viewtopic.php?t=394580
##############################################################
Would you like to proceed? (y/N) <==yを入力
Downloading bootloader tools
Downloading bootloader images
*** Downloading specific firmware revision (this will take a few minutes)
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
100 167M 0 167M 0 0 21.2M 0 --:--:-- 0:00:07 --:--:-- 18.9M
*** PREPARING EEPROM UPDATES ***
BOOTLOADER: update available
CURRENT: Tue 26 May 15:01:25 UTC 2026 (1779807685)
LATEST: Mon 29 Jun 00:07:01 UTC 2026 (1782691621)
RELEASE: latest (/usr/lib/firmware/raspberrypi/bootloader-2712/latest)
Use raspi-config to change the release.
CURRENT: Tue 26 May 15:01:25 UTC 2026 (1779807685)
UPDATE: Mon 29 Jun 00:07:01 UTC 2026 (1782691621)
BOOTFS: /boot/firmware
UPDATING bootloader. This could take up to a minute. Please wait
rpi-eeprom-ab update /tmp/tmp.rHBr9gpyNc
Marking next partition as valid
Force committing update
Force commit opposite: SUCCESS
UPDATE SUCCESSFUL
*** Updating firmware
*** Updating kernel modules
*** depmod 6.18.37-v8-rt+
*** depmod 6.18.37-v8+
*** depmod 6.18.37-v8-16k+
*** Updating VideoCore libraries
*** Running ldconfig
*** Storing current firmware revision
*** Deleting downloaded files
*** Syncing changes to disk
*** If no errors appeared, your firmware was successfully updated to c13f3fa9f499f4dfabe1ddd24a5b9c90d3580887
*** A reboot is needed to activate the new firmwareシステムの再起動をしましょう。
$ sudo reboot更新されたOSのバージョン確認は、
$ vcgencmd version
2026/06/29 00:07:01
Copyright (c) 2012 Broadcom
version f68405bc (release) (embedded)SSHのセキュリティ強度アップと整備
SSHのホスト鍵の更新
$ sudo rm -v /etc/ssh/ssh_host*
removed '/etc/ssh/ssh_host_ecdsa_key'
removed '/etc/ssh/ssh_host_ecdsa_key.pub'
removed '/etc/ssh/ssh_host_ed25519_key'
removed '/etc/ssh/ssh_host_ed25519_key.pub'
removed '/etc/ssh/ssh_host_rsa_key'
removed '/etc/ssh/ssh_host_rsa_key.pub'$ sudo dpkg-reconfigure openssh-server
Creating SSH2 RSA key; this may take some time ...
3072 SHA256:tE4OFvWUTPX34vbcxUzo8TYL2anIQdHAVr7d7K5piVo root@raspberrypi5 (RSA)
Creating SSH2 ECDSA key; this may take some time ...
256 SHA256:TMdKgWfnlWfYv+LB3KhgEF1d2ZhNwMLlXIEu1DH7zDU root@raspberrypi5 (ECDSA)
Creating SSH2 ED25519 key; this may take some time ...
256 SHA256:srMT4/+XYjwzMXIVrNH21X0izjXzmuW1wRyEr2L8DcM root@raspberrypi5 (ED25519)
ssh.socket is a disabled or a static unit not running, not starting it.SSHの設定変更
設定ファイルを開いて各種設定を変更する。
$ sudo vi /etc/ssh/sshd_config
ももぶろ
viの超簡単な使い方は、ここを見てね
既に定義されている行は内容の変更を、無い時は行を追加してください。
#が行頭に入っている行はコメントなので、追加しなくても大丈夫です。
####################
# ログインの高速化
####################
#IP V4に特定
AddressFamily inet
#hostがあればコメントに変更
#host *
#GSSAPIAuthenticationを未使用
GSSAPIAuthentication no
#########################
# SSHのセキュリティ設定
#########################
#sshでrootにlogin出来なくする
PermitRootLogin no
#セッションを張ってからログインするまでの猶予時間を長めに
LoginGraceTime 30
#リトライ回数設定して、一旦切断
MaxAuthTries 3
#SSHバージョン２のみ利用を許可します。
Protocol 2
#########################
# 接続を許可するユーザがある時は追加
#########################
#AllowUsers newuserももぶろ
接続を許可するユーザは、先程新しく作ったユーザを指定してね。
設定した内容が正しいか確認
下記のコマンドで設定した内容が正しいか確認。
$ sudo sshd -t <=正しいと何も表示されません。SSHのサービスを再起動
下記のコマンドで、SSHのサービスを再起動します。
$ sudo systemctl restart sshd.service <=正しく実行されると何も表示されません。後は、SSH(Teraterm)でログインできれば、問題なし。
ももぶろ
サーバ単体のセキュリティはこれで大丈夫
