IGLOS by Linutronix logo for secure embedded Linux systems

Tutorial Network

Network Access and SSH with IGLOS

Introduction

In the previous step of this tutorial, we walked through downloading IGLOS, flashing it to a microSD card, and booting your Raspberry Pi for the first time. After that step, you should have a working system with console access via keyboard and monitor.

While direct console access is useful for initial exploration, embedded systems are typically accessed and managed over a network. In this step, you will learn how to:

  • Connect your Raspberry Pi to a network and obtain an IP address via DHCP
  • Discover the IP address assigned to your device
  • Log into the system via SSH

By the end of this guide, your IGLOS device will be connected to your network and ready for remote access.

Network Connectivity

Connecting to Your Network

IGLOS comes with built-in support for network configuration via DHCP (Dynamic Host Configuration Protocol). This means your Raspberry Pi will automatically request an IP address from your network’s DHCP server when connected to Ethernet.

To connect your Raspberry Pi to your network, connect an Ethernet cable from your Raspberry Pi’s Ethernet port to your network router or switch.

The system will automatically request a DHCP lease from your network and should obtain an IP address within a few seconds.

Finding Your Device’s IP Address

Once your Raspberry Pi is connected to the network, you need to discover which IP address it has been assigned. There are several methods to do this. Expand the one that fits your setup:

Method 1: Check from the Raspberry Pi Console

If you still have keyboard and monitor connected, you can check the IP address directly from the Raspberry Pi’s console.

Log in with the default credentials (if not already logged in):

Username: iglos
Password: iglos

Then run the following command to display network interface information:

ip address

You should see output similar to:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute
       valid_lft forever preferred_lft forever
2: end0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 2c:cf:67:a1:30:e7 brd ff:ff:ff:ff:ff:ff
    altname enx2ccf67a130e7
    inet 192.168.1.175/24 brd 192.168.1.255 scope global dynamic noprefixroute end0
       valid_lft 85350sec preferred_lft 74550sec
    inet6 fe80::63b4:d175:3ae7:884f/64 scope link
       valid_lft forever preferred_lft forever

Look for the line starting with inet under the end0 interface. In this example, the IP address is 192.168.1.175.

Method 2: Check from Your Router

Most home network routers provide a web interface where you can view all connected devices.

  1. Open a web browser on another computer on your network and navigate to your router’s address (e.g. 192.168.178.1, but check your router’s documentation).
  2. Log in with your router’s administrator credentials.
  3. Look for a section in the main navigation menu labeled something like “Home Network”, “Connected Devices”, “Network Devices”, or “Device List”.
  4. In this section, you should see a list of all devices currently connected to your network. Look for an entry with:
    • Device Name: IGLOS
    • IP Address: This is what you need (usually formatted like 192.168.x.x)
    • MAC Address: Should match the link/ether address of the end0 interface

The router’s interface will display the IP address assigned to your device via DHCP.

Method 3: Use Network Scanning Tools

If you have access to your local network from another computer, you can use network scanning tools to discover your device, for example nmap.

First, open a terminal on your computer (see below). If nmap is not already installed on your system, install it first, e.g. on Debian/Ubuntu:

sudo apt-get install nmap

Then run the following command to scan your network:

sudo nmap -sn 192.168.1.0/24

Replace 192.168.1.0/24 with your network’s subnet. The output will list all active devices on your network by IP address, and by hostname where one can be resolved. Look for an entry with Raspberry Pi in it, for example:

Nmap scan report for IGLOS.localdomain (192.168.1.175)
Host is up (0.0030s latency). 
MAC Address: 2C:CF:67:A1:30:E7 (Raspberry Pi (Trading))

This indicates there is a device with the MAC address 2C:CF:67:A1:30:E7 matching a Raspberry Pi with the IP address 192.168.1.175 and hostname IGLOS.localdomain in your network. But be aware that this is just an indication. There might be other Raspberry Pi’s in your network or even an attacker forging the MAC address and/or hostname. Also, the hostname might not be displayed depending on your network configuration.

Secure Remote Access via SSH

Now that your device has a network IP address, you can access it remotely using SSH (Secure Shell). This allows you to explore your device without needing keyboard and monitor connected.

About SSH for Embedded Systems

⚠️ Important Security Notice

SSH with password authentication is not suitable for production embedded systems. The default user and password should be considered a security risk in any real-world deployment. SSH should be disabled or properly hardened (key-based authentication, restricted user accounts, firewall rules, etc.). Even with a secure configuration as is common for server systems, exposing a shell at all is considered a security risk for many embedded systems, and it can often be replaced by application-specific interfaces. Later steps of this tutorial will cover security hardening in detail, including how to disable SSH and what is typically used in production environments instead.

However, for development and exploration purposes, SSH access is invaluable. It allows you to experiment with the system without physical access, and to develop and test configurations live without lengthy build and update cycles. That is why embedded systems usually come in two image variants: one for internal development and one for production use.

Connect via SSH

Opening a Console/Terminal:

First, open a terminal on your computer:

  • Linux: Press Ctrl+Alt+T or search for “Terminal” in your application menu.
  • macOS: Press Cmd+Space, type “Terminal”, and press Enter.
  • Windows: Open “Windows Terminal” or “PowerShell” from the Start menu.

Once the terminal is open, connect to your IGLOS device by running:

ssh iglos@YOUR_DEVICE_IP

Replace YOUR_DEVICE_IP with the IP address you found in the previous section. For example:

ssh iglos@192.168.1.175

The first time you connect, SSH will ask you to verify the host’s identity:

The authenticity of host '192.168.1.175 (192.168.1.175)' can't be established.
ECDSA key fingerprint is SHA256:xyzabcdefghijklmnopqrstuvwxyz.
Are you sure you want to continue connecting (yes/no/fingerprint)?

To verify this fingerprint is authentic, you can log into the device locally (keyboard and monitor) and run:

ssh-keygen -l -f /etc/ssh/ssh_host_ecdsa_key.pub

If it matches, type yes and press Enter to continue.

Then, enter the password when prompted:

iglos@192.168.1.42's password:

Enter the default password iglos.

You should now have a remote shell session on your device:

iglos@iglos:~$

Congratulations! You now have remote SSH access to your device.

SSH Access After Reflashing

After you flash the microSD card again, you will likely get the following message the next time you try to log in:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ED25519 key sent by the remote host is
SHA256:V7dLUJtQBCe6Y9smfMf0faNydAUWND8dkZoTMPd6Zwf.
Please contact your system administrator.
Add correct host key in /home/username/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /home/username/.ssh/known_hosts:129
  remove with:
  ssh-keygen -f '/home/username/.ssh/known_hosts' -R '192.168.1.175'
Host key for 192.168.1.175 has changed and you have requested strict checking.
Host key verification failed.

Normally, you should be concerned when seeing this message, but in this case it is expected because the SSH host key was regenerated. Verify the fingerprint again as described above, then run the suggested command to remove the old key.

Key Takeaways

To summarize what you’ve learned:

  • Networking: IGLOS automatically configures network access via DHCP.
  • IP Discovery: Use ip address, your router’s interface, or network scanning tools to find your device.
  • SSH Access: Remote management via SSH enables network-based workflows for development and exploration.
  • Security Reminder: SSH is for development only; production systems need hardening (covered in later parts).

Troubleshooting

SSH Connection Refused

Problem: ssh: connect to host 192.168.1.42 port 22: Connection refused

Solutions:

  • Verify the device is connected to the same network as your PC and has an IP address.
  • Ensure you’re using the correct IP address and the Raspberry Pi is powered on.

What’s Next?

Continue to the next step in this tutorial.

Step 3: Software Updates with IGLOS

In that step, you’ll learn how to:

  • Understand and use the built-in software update mechanism (swupdate)
  • Perform your first over-the-network software update

Follow our LinkedIn channel to get informed when the next parts are online!