Deploying a Raspberry Pi for smart home hubs like Home Assistant, Pi-hole, or OctoPrint rarely requires a dedicated monitor and keyboard. Headless operation via Secure Shell (SSH) is the industry standard for managing Single Board Computers (SBCs). However, recent changes to Raspberry Pi OS security policies have fundamentally altered how remote access is provisioned. This guide details exactly how to SSH to Raspberry Pi devices, from pre-boot configuration to advanced cryptographic hardening.

Pre-Requisites: Enabling SSH Before First Boot

Historically, users enabled SSH by placing an empty file named ssh in the boot partition. While this still works on legacy images, the modern, secure method utilizes the official Raspberry Pi Imager.

In April 2022, the Raspberry Pi Foundation deprecated the default pi user account to mitigate brute-force vulnerabilities. You must now define a custom username and password before your first boot.

The Imager Workflow

  1. Open Raspberry Pi Imager and select your OS (e.g., Raspberry Pi OS Lite for headless servers).
  2. Click the Gear Icon (or press Ctrl+Shift+X / Cmd+Shift+X) to open the Advanced Options menu.
  3. Check Enable SSH and select Use password authentication (we will upgrade to key-based auth later).
  4. Set a custom username (e.g., admin or homeassistant) and a strong password.
  5. Configure your Wi-Fi SSID and password if not using Ethernet.

Flash the SD card. Upon booting, the Pi will automatically connect to your network with the SSH daemon running.

Network Discovery: Locating Your Pi on the LAN

Before you can connect, you need the Pi's IP address or local hostname. Raspberry Pi OS includes avahi-daemon by default, enabling mDNS (Multicast DNS) resolution.

Method 1: mDNS (The Easiest Route)

Open your terminal and ping the default hostname:

ping raspberrypi.local

If you changed the hostname in the Imager, use [your-hostname].local. The terminal will return the local IPv4 address (e.g., 192.168.1.45).

Method 2: ARP Scanning

If mDNS fails due to network isolation or VLAN configurations, scan your local subnet using the Address Resolution Protocol cache:

arp -a | grep b8:27:eb

(Note: b8:27:eb is the OUI prefix for older Raspberry Pi models. Newer Pi 4 and Pi 5 models often use prefixes like dc:a6:32 or 2c:cf:67.)

Method 3: Router DHCP Leases

Log into your router's admin panel (usually 192.168.1.1) and check the DHCP Client List for your custom hostname.

Step-by-Step: How to SSH to Raspberry Pi via Terminal

Once you have the IP address or .local domain, initiate the connection from your host machine (Windows PowerShell, macOS Terminal, or Linux).

ssh username@raspberrypi.local

The Fingerprint Prompt

On your first connection, you will see a warning:

The authenticity of host 'raspberrypi.local' can't be established. ED25519 key fingerprint is SHA256:xxxx... Are you sure you want to continue connecting (yes/no)?

Type yes and press Enter. This saves the Pi's public key to your ~/.ssh/known_hosts file, protecting you from Man-in-the-Middle (MitM) attacks on future connections. Enter your password when prompted.

Troubleshooting Common Connection Refused Errors

Headless setups often fail silently. Use this diagnostic table to resolve the most frequent SSH errors encountered during Pi deployments.

Error Message Root Cause Solution
Connection refused (Port 22) SSH daemon is not running or blocked by UFW. Re-flash with Imager SSH enabled, or connect a monitor and run sudo raspi-config to enable SSH.
Permission denied (publickey,password) Wrong username, or Pi is configured for key-only auth. Verify custom username. The default pi user no longer exists on modern images.
Network is unreachable Host machine is on a different subnet or Wi-Fi guest network. Ensure both devices are on the same primary LAN/VLAN.
WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! You re-flashed the SD card, generating new SSH keys. Run ssh-keygen -R raspberrypi.local to clear the old fingerprint from known_hosts.

For deeper diagnostics, append the verbose flag to your SSH command: ssh -vvv username@ip_address. This outputs the cryptographic handshake sequence and pinpoints exactly where the connection drops.

Securing Your SSH Connection for 24/7 Smart Home Nodes

Password authentication is vulnerable to brute-force attacks, especially if you eventually expose your Pi to the internet via Cloudflare Tunnels or port forwarding. The Raspberry Pi Remote Access Documentation strongly recommends key-based authentication.

Step 1: Generate an ED25519 Key Pair

On your host machine (not the Pi), generate a modern, secure key pair:

ssh-keygen -t ed25519 -C 'pi-cluster-admin'

Press Enter to accept the default save location (~/.ssh/id_ed25519). Add a passphrase for an extra layer of security.

Step 2: Deploy the Public Key

Push the public key to your Pi using ssh-copy-id:

ssh-copy-id -i ~/.ssh/id_ed25519.pub username@raspberrypi.local

Step 3: Disable Password Authentication

SSH into the Pi and edit the SSH daemon configuration file:

sudo nano /etc/ssh/sshd_config

Locate and modify the following parameters to match the OpenBSD sshd_config standards:

PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM no

Restart the daemon to apply changes:

sudo systemctl restart ssh

Streamlining Access with the SSH Config File

If you manage multiple SBCs (e.g., a Home Assistant node, a Pi-hole DNS server, and a Klipper 3D printer host), typing out usernames and IP addresses becomes tedious. Create an SSH config file on your host machine:

nano ~/.ssh/config

Add the following blocks:

Host pi-hole
    HostName 192.168.1.50
    User admin
    IdentityFile ~/.ssh/id_ed25519

Host homeassistant
    HostName hass.local
    User admin
    IdentityFile ~/.ssh/id_ed25519

Now, you can connect instantly by typing:

ssh pi-hole

This configuration file also allows you to set keep-alive intervals to prevent your router from dropping idle SSH sessions:

Host *
    ServerAliveInterval 60
    ServerAliveCountMax 3

Final Thoughts on Headless Pi Management

Mastering how to SSH to Raspberry Pi hardware is the foundational skill for any SBC enthusiast. By leveraging the Raspberry Pi Imager for headless provisioning, utilizing mDNS for network discovery, and enforcing ED25519 key-based authentication, you ensure your electrical and electronics projects remain both accessible and secure. Whether you are wiring up GPIO pins for a custom sensor array or deploying a fleet of Home Assistant nodes, a robust SSH configuration is the backbone of reliable remote management.