Create the boot media with Raspberry Pi Imager
Download Raspberry Pi Imager for your host computer and insert a compatible microSD card. Select Raspberry Pi OS Lite (64-bit) for a minimal headless image. In the advanced customization menu, set a hostname, enable SSH, and provide a username and password. Choose password authentication for simplicity or public-key authentication for stronger security. Imager writes the image and applies these settings so the Pi connects on first boot without further local setup.
- Use an SD card of at least 8 GB for Lite images or 32 GB when adding recommended software.
- Enable SSH in the Remote Access tab and select either password or public-key authentication.
- Enter Wi-Fi credentials if using wireless; wired Ethernet requires no extra configuration.
Configure networking for first-boot connectivity
Headless devices need reliable network access immediately. For wired setups, connect an Ethernet cable before powering on. The Pi obtains an address automatically via DHCP. For wireless, enter the SSID and password in Imager so the credentials are stored before the first boot. Hostnames set during imaging allow access via mDNS names such as my-pi.local instead of changing IP addresses. [raspberrypi.com](https://www.raspberrypi.com/documentation/computers/getting-started.html) warns that some boards and adapters lack 5 GHz support, so confirm compatibility to avoid connection failures.
- Test the network connection from another computer using ping or SSH once the Pi boots.
- Assign a static DHCP lease on your router if a consistent address is required for services.
- Avoid placing a wpa_supplicant.conf file manually on newer Raspberry Pi OS releases.
Enable and secure SSH access
SSH provides the primary remote command-line interface. Enable it during imaging or by creating an empty ssh file in the bootfs partition. After the first successful login, generate or copy an SSH key pair on your client machine and add the public key to the Pi. Public-key authentication removes the need to transmit passwords over the network. Use the ssh username@hostname.local command to connect. Once logged in, run raspi-config to enable VNC if a graphical session is later required, though VNC is unavailable on Lite images.
- Store the private key securely on the client and never share it.
- Disable password authentication after confirming key-based login works.
- Change the default username during imaging to reduce exposure to automated attacks.
Apply updates and maintain the system
After the first SSH connection, update the package lists and installed software. Run sudo apt update followed by sudo apt full-upgrade. Schedule regular updates or use Raspberry Pi Connect for remote push updates on supported devices. Enable user lingering on Lite installations to keep services running after logout. These steps keep security patches current and prevent drift between the initial image and the running system.
- Reboot after major upgrades to load new kernels and libraries.
- Review changelogs for breaking changes before applying updates on production devices.
- Consider A/B boot layouts created with rpi-image-gen for automatic rollback on failed updates.
Manage identity and plan for recovery
Create a strong, unique password or key pair during imaging and store recovery details offline. Document the hostname, IP address if static, and SSH key location. For recovery, keep a second SD card imaged with the same settings or maintain a recent backup of configuration files. If the device becomes unreachable, physical access to the SD card allows re-imaging without data loss on external storage. Test the full boot and SSH sequence on a spare card before deploying the production unit.
- Record the encrypted password hash generated by openssl passwd -6 for manual userconf.txt setups.
- Store SSH public keys and network details in a secure, version-controlled location.
- Label SD cards clearly and keep a spare imaged card for quick field replacement.