Set Up a Raspberry Pi From Scratch

A fresh Raspberry Pi is one of the most satisfying bits of hardware to bring to life. Whether you are running a home server, a network ad-blocker, or just learning Linux on cheap hardware, the process is the same: pick the right model, write a good image, configure it before first boot, and lock it down. This guide covers the current Raspberry Pi OS (Bookworm, 64-bit) and the official Raspberry Pi Imager workflow, which replaced manual cloud-init and wpa_supplicant file-dropping for most use cases.

1. Choose the Right Model

The Raspberry Pi line has several active models. For most server or desktop work in 2024, pick one of these:

• Pi 5 (4 GB / 8 GB) — fastest, PCIe slot, active cooling required under sustained load. Best for general computing or heavier server roles.
• Pi 4 Model B (2 GB / 4 GB / 8 GB) — still excellent, widely available, lower power draw than Pi 5. Good default choice.
• Pi Zero 2 W — cheap, tiny, single-core penalty under load. Use it for lightweight IoT or embedded tasks, not as a general server.

You also need: a microSD card (Class 10 / A1 or A2, 16 GB minimum — 32 GB recommended), a reliable 5 V power supply rated for your model (Pi 4 needs 3 A USB-C; Pi 5 needs 5 A USB-C), and a card reader connected to your workstation.

2. Download and Install Raspberry Pi Imager

Raspberry Pi Imager handles downloading the OS image, writing it, and embedding first-boot configuration all in one step. Install it on your workstation.

Debian / Ubuntu

sudo apt install rpi-imager

Fedora / RHEL family

sudo dnf install rpi-imager

Arch

sudo pacman -S rpi-imager

If your distro does not package it, grab the AppImage or .deb from raspberrypi.com/software. A macOS and Windows build is also available from the same page.

3. Write the Image with Headless Configuration

Headless means the Pi boots and connects to your network without ever needing a keyboard or monitor. Raspberry Pi Imager makes this straightforward through its "OS Customisation" panel, which writes configuration into the image before it hits the SD card.

1. Launch rpi-imager.
2. Click Choose Device and select your Pi model.
3. Click Choose OS → Raspberry Pi OS (other) → Raspberry Pi OS Lite (64-bit) for a headless server, or the full desktop build if you want a GUI.
4. Click Choose Storage and select your microSD card. Double-check the device — Imager will erase it completely.
5. Click Next. Imager asks if you want to apply OS customisation. Click Edit Settings.

OS Customisation Settings

Fill in the following tabs before writing:

• Hostname — set something meaningful, e.g. pihole or homeserver.
• Username and password — the default pi user is gone since Bookworm; set your own username and a strong password here.
• Wi-Fi — enter your SSID, password, and country code. Skip this if you are using Ethernet (recommended for servers).
• Locale — set timezone and keyboard layout.
• Services tab → Enable SSH → Use password authentication (switch to key-based after first login).

Click Save, then Yes to apply customisation, then Yes again to confirm the write. Imager downloads the image and writes it — this takes two to five minutes depending on your internet speed and card speed.

4. First Boot and SSH Login

Eject the card safely, insert it into the Pi, and apply power. On first boot the Pi expands the filesystem, applies your customisation settings, and starts the SSH daemon — all automatically. Give it 60–90 seconds.

Find the Pi's IP address. If your router has a DHCP lease table, check there. Alternatively:

ping -c 1 hostname.local

Replace hostname with whatever you set in Imager. mDNS (avahi) resolves .local names on most networks. If it does not resolve, use your router's admin page or a tool like nmap -sn 192.168.1.0/24 to find it.

ssh [email protected]

Accept the host key fingerprint on first connection. You should land at a Bash prompt.

5. Switch to SSH Key Authentication

Password SSH is fine to get in the first time. Disable it immediately after adding a key.

On your workstation, generate a key pair if you do not already have one:

ssh-keygen -t ed25519 -C "pi access"

Copy the public key to the Pi:

ssh-copy-id [email protected]

Test that key login works, then on the Pi disable password authentication:

sudo sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl restart ssh

6. Update the System

Raspberry Pi OS is Debian-based, so updates use apt. Run a full upgrade immediately after first login.

sudo apt update && sudo apt full-upgrade -y

After a kernel update, reboot:

sudo reboot

Reconnect after 30–60 seconds and confirm the running kernel version:

uname -r

Output will look something like 6.6.31+rpt-rpi-v8 — the exact version varies.

7. Basic Hardening and Configuration

Enable the Firewall

Raspberry Pi OS Lite ships with nftables under the hood but no active ruleset. The easiest layer to add is ufw:

sudo apt install ufw -y
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw enable

Add more ufw allow rules as you install services. For example, sudo ufw allow 80/tcp for a web server.

Set the Correct Timezone

If you did not set this in Imager, do it now:

sudo timedatectl set-timezone Europe/London

Replace Europe/London with your zone from timedatectl list-timezones.

Enable Automatic Security Updates (Optional)

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

8. Verify the Setup

Run a quick checklist before considering the Pi production-ready:

# System info
hostnamectl

# SSH service status
systemctl status ssh

# Firewall status
sudo ufw status verbose

# Disk usage (make sure filesystem expanded)
df -h /

The df output should show nearly the full capacity of your SD card used as /. If it shows only a few gigabytes, the automatic expansion did not run — reboot once and check again.

Troubleshooting

• Pi does not appear on the network after 2 minutes: Check power supply — an underpowered Pi will boot erratically or not at all. The Pi 4 needs a genuine 3 A supply; phone chargers often lie about their rating.
• SSH connection refused: SSH was not enabled in Imager, or the Pi is still booting. Re-flash with SSH enabled, or connect a keyboard and monitor to diagnose.
• hostname.local does not resolve: mDNS may be blocked on your network. Use the IP address directly. Install avahi-daemon if it is missing: sudo apt install avahi-daemon.
• SD card corruption after a few weeks: Common with cheap or counterfeit cards. Buy from a known brand (Samsung, SanDisk, Kingston). For any write-heavy workload, consider booting from a USB SSD instead — the Pi 4 and 5 support USB boot natively.
• Pi 5 overheating under load: The Pi 5 requires active cooling. The official active cooler or a third-party heatsink-fan combo is not optional for sustained workloads.