How to Remote Login to Raspberry Pi: Headless SSH Setup & Hardware Status Node

To remote login to a Raspberry Pi, you need the SSH daemon enabled, the board's local IP address, and an SSH client on your host machine. However, running a Pi completely headless (without a monitor or keyboard) introduces a physical problem: if the network drops or the OS freezes, you have no visual feedback and no safe way to power down without corrupting the microSD card. This guide answers exactly how to remote login to Raspberry Pi 5 running Pi OS Bookworm, while wiring a hardware status node to monitor network health and trigger a safe shutdown.

Project Overview & Hardware Spec Sheet

This build assumes you are deploying a Raspberry Pi 5 (4GB variant) as a headless server or IoT node. The Pi 5 requires the official 27W USB-C PD power supply to maintain stable GPIO voltage under load, especially when driving external LEDs and monitoring network interfaces.

Wiring the Headless Status & Safe-Shutdown Node

Before applying power, wire the GPIO header. We are using BCM pin numbering. The green LED indicates an active internet connection, the red LED indicates the SSH daemon is listening, and the pushbutton provides a physical safe-shutdown trigger.

Headless SSH Configuration (Pi OS Bookworm)

If you are flashing a fresh microSD card and do not have a monitor to enable SSH via raspi-config, you must inject configuration files into the boot partition before inserting the card into the Pi.

1. Flash the OS: Use Raspberry Pi Imager to write Pi OS Bookworm (64-bit) to your SanDisk A2 microSD card.
2. Enable SSH: Open the boot/firmware partition on your PC. Create an empty file named exactly ssh (no file extension). This tells the OS to enable the SSH daemon on first boot.
3. Set Default User: In the same boot/firmware directory, create a file named userconf.txt. Add a single line: pi:$6$YOUR_HASHED_PASSWORD. (You can generate the hashed password using openssl passwd -6 on a Linux host, or use the Raspberry Pi Imager's advanced settings GUI to inject this automatically).
4. Configure WiFi (Optional): If using WiFi instead of Ethernet, create NetworkManager connection files in /etc/NetworkManager/system-connections/ post-boot, or use the Imager GUI to pre-fill SSID and PSK. Note that Bookworm deprecated wpa_supplicant.conf.
5. Boot and Locate IP: Insert the card, apply the 27W PSU, and check your router's DHCP client table for a device named raspberrypi to find its assigned IP address.

Python Status Monitor & Safe Shutdown Script

This Python script targets the Raspberry Pi 5 (4GB). It uses the gpiozero library to manage the hardware pins and subprocess to poll network and SSH daemon status. It includes error handling to prevent the script from crashing if a network interface temporarily drops.

import time
import subprocess
import os
import sys
from gpiozero import LED, Button
from signal import pause

# --- Pin Definitions (BCM Numbering) ---
NET_LED = LED(17)
SSH_LED = LED(27)
SHUTDOWN_BTN = Button(22, pull_up=True, bounce_time=0.1)

def check_ssh_active():
    """Checks if the SSH daemon is actively listening on port 22."""
    try:
        result = subprocess.run(['ss', '-tln'], capture_output=True, text=True, timeout=2)
        return ':22' in result.stdout
    except subprocess.TimeoutExpired:
        print('Warning: ss command timed out')
        return False
    except Exception as e:
        print(f'Error checking SSH status: {e}')
        return False

def check_network():
    """Pings a reliable external DNS to verify Layer 3 internet connectivity."""
    try:
        result = subprocess.run(['ping', '-c', '1', '-W', '2', '8.8.8.8'], capture_output=True, timeout=3)
        return result.returncode == 0
    except Exception:
        return False

def safe_shutdown():
    """Triggers a safe OS shutdown to prevent SD card corruption."""
    print('Shutdown button pressed. Safely powering off...')
    SSH_LED.blink(0.2, 0.2)
    NET_LED.blink(0.2, 0.2)
    os.system('sudo shutdown -h now')

# Bind the button press event
SHUTDOWN_BTN.when_pressed = safe_shutdown

print('Status monitor active. Press Ctrl+C to exit.')
try:
    while True:
        NET_LED.value = check_network()
        SSH_LED.value = check_ssh_active()
        time.sleep(3)  # Poll every 3 seconds to minimize CPU overhead
except KeyboardInterrupt:
    print('Monitor stopped by user.')
    sys.exit(0)

How to extend or simplify this build: To simplify, omit the LEDs and rely purely on router logs for network status. To extend, integrate the Tailscale daemon into the script's startup sequence to automatically establish a secure mesh VPN, allowing remote login over the internet without exposing port 22 to the public WAN.

Debugging: "Connection Refused" and Network Drops

When attempting to remote login, the most common failure mode on a fresh headless Bookworm install is the SSH daemon rejecting the connection. If your terminal returns this exact error string:

ssh: connect to host 192.168.1.50 port 22: Connection refused

Here are the ranked causes and the first three things to check when it fails:

1. Verify the Pi actually booted (Physical Check): Look at the green ACT LED on the Pi 5 board. If it is completely dark or blinking in a repetitive, rhythmic pattern (e.g., 4 long, 4 short), the board is failing to read the microSD card or has encountered a kernel panic. The OS never reached the point of starting the SSH daemon.
2. Ping the IP address (Layer 2/3 Check): Run ping 192.168.1.50 from your host PC. If the ping fails, the Pi is not on the network. Check your router's DHCP table; the Pi may have been assigned a different IP address upon booting.
3. Verify the ssh file drop (Software Check): If the ping succeeds but SSH is refused, the SSH daemon is disabled. Power down the Pi, mount the SD card on your PC, and ensure the empty ssh file was placed in the root of the boot/firmware partition, not inside a subfolder. Windows often hides file extensions, resulting in a file actually named ssh.txt, which the Pi OS ignores.

FAQ: Remote Access to Raspberry Pi