Raspberry Pi OS Server Administration Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

Where Raspberry Pi OS sits

Raspberry Pi OS is Debian-based and aimed at the Pi. apt is the package manager. Current images ask you to create the user in Raspberry Pi Imager. There is no default pi user with a published password on those images. Do not bring that old password back.

Bookworm-era images generally use NetworkManager. Older images often used dhcpcd. Check this card and this image before you edit. A static lab address of 192.0.2.10/24 is documentation and a poor match for a home LAN. Use the prefix you actually route, and write it down. raspi-config is for local console tasks. Prefer a reviewed file or NetworkManager profile when the change must be repeatable.

The SD card is the disk. Power supplies that are slightly too weak corrupt them. Backups matter more because the card is one point of failure. The storage and backup guides apply, scaled to a small machine. This is rarely the right host for a rack service other people depend on.

64-bit is the current usual choice. 32-bit is a decision you record. A HATs and GPIO project is fine. A public web server on a home address is the web guide plus a careful firewall, not a default.

The first hour on a lab host

Step 1 on Raspberry Pi OS covers the image. Record 32-bit or 64-bit and the OS version. Create the user in Imager. The default published password is retired. The check is: The user name in the ticket can log in, and pi is not a login. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for Raspberry Pi OS draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

Step 2 on Raspberry Pi OS covers power and card. Use a supply that meets the board's rating. Confirm the card has free space before you patch. Brownouts look like software bugs. The check is: The board is stable through a reboot. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for Raspberry Pi OS draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

Step 3 on Raspberry Pi OS covers network tool. See whether NetworkManager or dhcpcd is active. Configure that one with the prefix you really use. A documentation address that your router does not use will strand the Pi. The check is: The address survives reboot and you can SSH to it. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for Raspberry Pi OS draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

Step 4 on Raspberry Pi OS covers SSH. Key login for the named user. Then follow the hardening order before you expose SSH beyond your prefix. A Pi on a home LAN is still a computer. The check is: An address outside the prefix cannot connect if you claimed the firewall or router limit. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for Raspberry Pi OS draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

Step 5 on Raspberry Pi OS covers updates. apt update and upgrade with a person who can see the console. There is no out-of-band chip. The check is: The host returns after reboot and the version is recorded. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for Raspberry Pi OS draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

# Raspberry Pi OS lab. Review before you paste.
# User comes from Imager. No default pi password.
# Confirm NetworkManager vs dhcpcd.
# Do not publish a management port on the public internet.
# prompt-for-this is not a password to keep.

The commands you will actually repeat

apt update and upgrade from Raspberry Pi OS and Debian repositories this image uses. Read the list. Reboot when the kernel or the firmware package needs it, with the console nearby because a Pi does not have a lights-out controller.

The user you created is the admin. Key-based SSH from the hardening guide is still the right end state. Password login stays only until the key works.

If NetworkManager is in charge, use it. If dhcpcd is in charge, use that. Do not enable both.

Watch disk space. A full card fails in ugly ways. Logs need a cap from the logging guide.

What Raspberry Pi OS is not

Raspberry Pi OS is not a datacenter distribution with a remote console.

It is not Ubuntu Server, even though both use apt. netplan is not the default here.

The old pi / raspberry login is not a step. It is a mistake on a current image.

The hour you stop

Write the hostname, the role, and the clock time before you change Raspberry Pi OS. If this host is also serving users, it is not the lab and this first hour belongs on a spare. The provisioning guide is how the spare gets built. A change without a spare is a change you can still postpone.

Keep the console or the out-of-band path open for the whole hour. Reloading a network service, a firewall, or a secure-shell daemon from the only session is how a lab becomes a drive across town. The hardware guide names that path for a physical machine. A virtual machine uses the hypervisor console. A cloud instance uses the serial console the platform gives you. Test it before the reload, not after.

The address 192.0.2.10/24 and the gateway 192.0.2.1 are documentation. They belong in the lab note and nowhere else. On a real network, use the prefix the network desk already assigned. On a cloud instance, use the address the platform assigned and do not hard-code the documentation range into user-data. If a generator filled the documentation address into a production draft, delete it.

prompt-for-this is a reminder that a secret is missing. It is not a password you set, not a token you commit, and not a string you leave in a configuration file because the service started. The real secret lives in the password store. The ticket says who can read it. A file that still contains the reminder is a file you have not finished.

One service is enough for the first hour on Raspberry Pi OS. The purpose from the fundamentals page says which service. Every other package stays uninstalled until its own guide has a ticket. A host that enables a web server, a database, and a queue in the first hour has three changes and no proof. Finish the login, the address, and the update. Then stop.

Read the package transaction before you accept it. A count of packages is not a review. If the list contains a repository you did not add, stop. If it contains a kernel, the patch guide's reboot decision applies and the console stays open. If it contains software this role does not need, remove that line from the plan rather than installing it and disabling it later.

The previous image, the previous configuration file, or the previous package version is the rollback. Write the path down while the host still works. A rollback you invent after a failed reload is a guess. The migration guide assumes the old copy is still there. Do not delete it in the same hour to free a disk.

When the checks pass, copy the notes into the ticket and leave the host alone. The next host waits until a second person can repeat the login and the address from the notes. A fleet built from memory drifts. A fleet built from the file the provisioning guide stored stays boring, which is the point of Raspberry Pi OS in production.

If a step on Raspberry Pi OS fails twice, stop for the day. The failure is the result. Adding a forum command beside a half-applied config produces a host nobody can rebuild. Rebuild from the image instead. The time you lose is smaller than the time you will spend explaining the hybrid.

Hand the finished lab to the guide that matches the role: web, mail, storage, backup, or hardening. Raspberry Pi OS being installed is not the same as the role being ready. The role guide has its own proof. Do not skip it because the package manager exited without an error.

A second person reads the hostname, the address, and the rollback path aloud before you build the next host. If they cannot find those three in the ticket, the notes are not done. Silence is not agreement. The check is the sentence they repeat back.

Store the working notes next to the image version. A month from now Raspberry Pi OS will still boot from that pair, and the chat where you remembered a flag will be gone. The file is the memory. The host is replaceable. That is the whole point of writing this hour down.

Raspberry Pi OS checks before a second host

Confirm this before you call the change done: Raspberry Pi OS is the OS the hostname reports, not a neighbour you copied from. The lab address 192.0.2.10/24 is gone before this host is placed on a real network. prompt-for-this is not the password that was set, and no password is in the ticket. The named admin can log in with a key. The package manager used is the one this page names. A network file from a different distribution was not pasted in. The config test or the apply command for this network tool succeeded. The previous image or install file is kept. No new third-party repository was added in the first hour. A service you do not need was not enabled to see what it does. Console or out-of-band access works before you reload SSH. A second person read the hostname and the address. There is no pi user with a known password. The network tool was identified before editing. Free space on the card was checked. The supply and the board model are in the inventory. And SSH is not open to the whole internet. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.