IGLOS by Linutronix logo for secure embedded Linux systems
Getting Started with IGLOS on Raspberry Pi

Introduction

IGLOS is a Debian-based operating system for embedded systems, designed to meet high cybersecurity standards such as those defined by the Cyber Resilience Act (CRA) and IEC 62443.

Unlike servers and desktop PCs, embedded systems typically interact with users through purpose-built interfaces. Combined with strict security mechanisms, this can make it difficult to understand what is happening under the hood or how to build and configure an embedded system from the ground up.

To make these concepts easier to explore, we have assembled a minimal variant of IGLOS with intentionally insecure default settings. This environment is designed for hands-on experimentation, allowing you to investigate the system’s inner workings without the restrictions imposed by a hardened configuration.

Throughout this tutorial series, we will gradually explore the system and learn how to configure it securely, applying the security principles and mechanisms needed to build a robust embedded system.

In this tutorial you will learn how to:

  • Flash and boot the operating system image
  • Log in to the local console using a keyboard and monitor

By the end of this guide, your Raspberry Pi will be running IGLOS and is ready for the next steps.

What You Need

Before you begin, gather the following hardware.

  • A Raspberry Pi 5
  • A computer running Linux, macOS, or Windows
  • A microSD card with at least 8 GB capacity (this provides sufficient headroom for experimentation; optimizations for achieving smaller storage requirements are possible; if you buy one, look for at least UHS-I U3 for lower write times)
  • A microSD card reader (preferably one matching the speed class of your microSD card)
  • An HDMI monitor
  • An HDMI cable (optional with adapter) suitable for the micro HDMI port of the Raspberry Pi
  • A USB keyboard
  • An official or compatible Raspberry Pi power supply

Tip: Using a good quality power supply helps to avoid boot problems caused by insufficient voltage.

Step 1 – Download the IGLOS Image

Download the latest IGLOS Tutorial image from the following link:

https://nextcloud.linutronix.de/public.php/dav/files/4wMznQdFKCitEcb/IGLOS_Tutorial_13.6.1.img.xz

The download is provided as a compressed image file ending in .img.xz.

There is no need to extract the archive. The next steps will work directly on the compressed image.

Step 2 – Prepare the microSD Card

Insert your microSD card into your computer.

Warning

Flashing an operating system image completely erases the contents of the microSD card. Make sure any important data has been backed up first.

There are many different options available to flash an image onto a microSD card. For beginners, the Raspberry Pi Imager provides a user-friendly interface to minimize errors. Experienced developers usually prefer a command line approach that is more suitable for faster development cycles.

Option A – Flash with Raspberry Pi Imager

Install Raspberry Pi Imager on Debian or Ubuntu

Follow the official installation instructions at raspberrypi.com/software to download and install Raspberry Pi Imager for Linux.

Note: On Ubuntu, Raspberry Pi Imager is available directly from the package repositories via sudo apt install rpi-imager. This is not the case on Debian where you could use the provided AppImage or the command line option below.

Once the installation has completed, start Raspberry Pi Imager either from your desktop’s application menu or by running:

rpi-imager

Install Raspberry Pi Imager on macOS

Download the Raspberry Pi Imager installer for macOS from the Raspberry Pi website.

Open the downloaded .dmg file and drag Raspberry Pi Imager into your Applications folder.

Launch it from Applications or using Spotlight.

Install Raspberry Pi Imager on Windows

Download the latest Raspberry Pi Imager installer from the Raspberry Pi website.

Run the installer, accept the default installation options, and finish the installation. Afterwards, launch Raspberry Pi Imager from the Start menu.

Flash the Image

The following steps are identical on Linux, macOS and Windows.

  1. Start Raspberry Pi Imager.
  2. Click Choose Device and select Raspberry Pi 5.
  3. Click Choose OS.
  4. Scroll to the bottom of the operating system list.
  5. Select Use Custom.
  6. Browse to the downloaded .img.xz file and select it.
  7. Click Choose Storage and select your microSD card.
  8. Click Next.
  9. At Would you like to apply OS customisation settings you click No.
  10. Double-check that the correct storage device is selected, then click Yes.
  11. If requested, enter your password.
  12. Wait until both writing and verification have completed.

Afterwards, safely eject the microSD card.

Option B – Flash from the Command Line (Debian or Ubuntu)

If you prefer working from the terminal, you can write the image directly using dd. This section can be skipped if you are using the Raspberry Pi Imager (or any other similar GUI tool).

Install the Required Tools

First, ensure that the required utilities are installed:

sudo apt update
sudo apt install xz-utils coreutils util-linux

The xz-utils package provides the xzcat command that decompresses the image while it is written to the microSD card.

Find the Correct microSD Card

This is the most important step of the command-line flashing process.

The dd command writes directly to a storage device without asking for confirmation. Selecting the wrong device could overwrite another hard drive or SSD and permanently destroy its contents.

Compare Before and After

Before inserting the microSD card, run:

lsblk -o NAME,SIZE,MODEL,RM,TYPE,MOUNTPOINTS

You may see something similar to:

NAME                           SIZE MODEL                      RM TYPE  MOUNTPOINTS
nvme0n1                      476.9G SAMSUNG MZVLB512HBJQ-000L7  0 disk
├─nvme0n1p1                    976M                             0 part  /boot/efi
├─nvme0n1p2                    977M                             0 part  /boot
└─nvme0n1p3                    475G                             0 part  /

Now insert the microSD card and run the command again:

lsblk -o NAME,SIZE,MODEL,RM,TYPE,MOUNTPOINTS

Example:

NAME                           SIZE MODEL                      RM TYPE  MOUNTPOINTS
sdb                            7.5G Storage Device              1 disk
├─sdb1                       244.1M                             1 part
└─sdb2                         4.8G                             1 part
nvme0n1                      476.9G SAMSUNG MZVLB512HBJQ-000L7  0 disk
├─nvme0n1p1                    976M                             0 part  /boot/efi
├─nvme0n1p2                    977M                             0 part  /boot
└─nvme0n1p3                    475G                             0 part  /

The newly appearing device (sdb in this example) is your microSD card.

Always check that the reported size matches your microSD card. But be aware that due to the difference between GB (gigabytes, based on powers of 10, as used by manufacturers) and GiB (gibibytes, based on powers of 2, as used by many operating systems), the size might be slightly different from what you expect. For example, a 16 GB SD card will typically be reported as having about 14.9 GiB.

Never rely solely on the device name. /dev/sdb today might become /dev/sdc tomorrow depending on which devices are connected.

The MODEL column gives further indication about the device, while the RM (Removable) column indicates whether Linux considers the device removable. That is, your microSD card should have a 1 in RM.

Use the Entire Device

The image must be written to the entire device, not one of its partitions.

Write to the device itself (like /dev/sdb), not to a partition (like sdb1). Writing to a partition instead of the complete device will produce an unbootable SD card.

If you are not completely sure that you have identified the correct device, stop here. Remove the card, run lsblk again, insert it once more, and compare the results. Spending another minute checking is far better than accidentally overwriting another drive.

Unmount the Card

Unmount any mounted partitions before writing:

sudo umount /dev/sdb*

Replace sdb with the correct device on your system.

Write the Image

Write the compressed image directly to the microSD card. Replace /dev/YOUR_DEVICE with the device you identified in the previous step!

xzcat IGLOS_Tutorial_13.6.1.img.xz | sudo dd of=/dev/YOUR_DEVICE bs=4M status=progress conv=fsync

You will be asked to provide your password, unless you have already configured your system otherwise. Depending on your SD card and card reader, writing the image may take several minutes.

The microSD card can now be removed safely.

Option C – Flash from the Command Line (macOS)

macOS already includes the required tools for writing compressed images.

Find the Correct microSD Card

As on Linux, identifying the correct device is the most important step.

Run:

diskutil list

before inserting the microSD card and once again afterwards.

A new device should appear, for example:

/dev/disk2 (external, physical)

To display more detailed information, run:

diskutil info /dev/disk2

Example:

Device Node:              /dev/disk2
Device Location:          External
Media Name:               SD Card
Disk Size:                14.9 GB
Protocol:                 USB

Before continuing, verify that:

  • the device appeared only after inserting the card,
  • it is marked as External,
  • the reported size matches your microSD card,
  • and it is the entire device (/dev/disk2), not a partition such as /dev/disk2s1.

If you are unsure, remove the card and repeat the process until you can confidently identify it.

Unmount the Card

diskutil unmountDisk /dev/disk2

Write the Image

Once you have identified the correct device, replace <disk> in the following command with your device name.

For example, if your device is /dev/disk2, replace <disk> with disk2. The command will then write to the corresponding raw device (/dev/rdisk2), which is typically faster than using the buffered device.

xzcat IGLOS_Tutorial_13.6.1.img.xz | sudo dd of=/dev/r<disk> bs=16m

When the command has completed, eject the microSD card:

diskutil eject /dev/<disk>

Wait until macOS reports that the disk has been ejected successfully before removing the microSD card.

Step 3 – Assemble the Raspberry Pi

Insert the prepared microSD card into the Raspberry Pi.

Then connect:

  • HDMI monitor
  • USB keyboard
  • Power supply

As soon as power is connected, the Raspberry Pi starts automatically.

Step 4 – First Boot

After the boot has finished, a login prompt will appear.

Log in using the following default username and password.

Username: iglos
Password: iglos

Congratulations! Your Raspberry Pi is now running IGLOS.

Troubleshooting

Nothing appears on the screen

  • Verify the HDMI cable is connected correctly.
  • Check that the monitor is switched on.
  • Select the correct HDMI input.
  • Disconnect and reconnect the power supply.

The Raspberry Pi does not boot

  • Make sure the image was written successfully.
  • Try writing the image again.
  • Try another microSD card.
  • Verify that your power supply provides sufficient power.

Login does not work

  • Double-check the username and password.

Need further assistance

What’s Next?

Note that the current system is meant for exploration only and has no security features enabled and no secure configuration at all. For that reason it should never be used for any productive use case. Hardening of the system for security will be explained in the later steps of this tutorial.

Continue to the next step in this tutorial.

Step 2: Network Access and SSH

In this step, you’ll learn how to:

  • Connect your Raspberry Pi to a network
  • Discover your device’s IP address using multiple methods
  • Access your device remotely via SSH

Follow our LinkedIn channel to get informed when the next parts are online!