Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A security update for the Raspberry Pi

raspberrypi.org

Post reply on HN
Print view View original

11–20 of 38 posts

Re: A security update for the Raspberry Pi

#11

Post by VLM »

jepler wrote: post #4

A great enhancement would be: if this file (/boot/ssh) is not empty, and ~root/.ssh/authorized_keys doesn't exist, then copy the file there and set up key-only ssh access.

Another great enhancement is a lot of ethernet speaking hardware ships with a sticker or something containing the MAC address but not the pi.

If the PI shipped with a little sticker containing the MAC address that would be quite trivial to change the username and password to the mac address as seen by /sbin/ifconfig which optimistically matches the physical sticker.

Of course there aren't many possible MAC addresses however, there are more than just one.

Another entertaining idea is if you're on a private network that can't access 8.8.8.8 or whatever then assume its safe to enable ssh by default.

Or if some sort of "what is my ip address" service returns a public ip addrs that matches /sbin/ifconfig then here be dragons and disable ssh by default.

Another fun idea is when you boot the first time sshd is enabled for.... a little while, and then blocked after some time or a power cycle. Some crontabs support a syntax like @reboot sleep 300 && block_ssh.sh where block_ssh engages a iptables rule that eats incoming ssh port packets. Or whatever time period feels right. So if you're on a public network and worried, simply boot and don't plug in for 6 minutes or whatever, and you're good. Or if you want ssh then you boot, and fast as possible log in via ssh and enable it. For the extra paranoid note its not hard with a script to ensure you get 5 minutes of working ssh only once per burning of the flash image, assuming your flash isn't in write protect mode LOL.

OH edited to add my favorite new idea, if you boot and GPIO port #something is pulled to ground, then enable SSH going forward. Sure would be nice if that GPIO pin were adjacent to gnd pin. Maybe you could code in something that flashes onboard LEDs to provide feedback.

Re: A security update for the Raspberry Pi

#12

Post by Declanomous »

alexellisuk wrote: post #6
aq3cn wrote: post #2

TL;DR > put a file called ssh in the /boot/ directory with any content to enable SSH which we turned off by default to prevent unauthorized access of your devise in public network. I wonder how many people are going to scratch their head when their headless Raspberry Pi will be unable to connect to their laptop in same way as earlier without this piece of information. I hope running sudo apt-get update, notifies them…

Yes this ruins just about every Pi from scratch tutorial. The worst part is if this affects the "lite" distro which is headless. The beauty of using an image like Raspbian Lite was being able to flash, ssh (ip via DHCP), change password/hostname and done.

If you can flash an sd card you can turn on SSH with the new method. All my Pi's are headless, and this is a mild inconvenience at best. Way less inconvenient than the internet falling apart because users don't know anything about security.

Re: A security update for the Raspberry Pi

#13

Post by Declanomous »

tym0 wrote: post #10

Isn't it a bit overkill? it's not like you can access them from the internet if they're on the local network. No?

You could say that about almost every internet connected device. I know more than one "tech-savvy" individual who has disabled their firewall "temporarily" to get something working, and then never re-enabled it, or dropped a device in the DMZ, etc.

Re: A security update for the Raspberry Pi

#14

Post by krylon »

tym0 wrote: post #10

Isn't it a bit overkill? it's not like you can access them from the internet if they're on the local network. No?

If you have a Pi (or several) on a private network, say, behind a NAT router, there should be no problem either way.

I guess a sufficient number of people have put Pis on the Internet, or the recent wave of IoT-DDOS attacks has spooked the Raspberry people sufficiently to make this change.

Re: A security update for the Raspberry Pi

#15

Post by falcolas »

jcriddle4 wrote: post #9

I wonder if instead they could setup a fake or jailed SSH that would let you login, it would then display helpful info about how to really enable SSH and then it would kick you out?

Given that you can specify a "shell" on SSH login, it's definitely possible.

Re: A security update for the Raspberry Pi

#16

Post by mercora »

VLM wrote: post #11
jepler wrote: post #4

A great enhancement would be: if this file (/boot/ssh) is not empty, and ~root/.ssh/authorized_keys doesn't exist, then copy the file there and set up key-only ssh access.

Another great enhancement is a lot of ethernet speaking hardware ships with a sticker or something containing the MAC address but not the pi. If the PI shipped with a little sticker containing the MAC address that would be quite trivial to change the username and password to the mac address as seen by /sbin/ifconfig which optimistically matches the physical sticker. Of course there aren't many possible MAC addresses…

OpenWrt does it somewhat like described. If booted unconfigured you can ssh into it as root without any password. The web interface asks for a new one as the first thing to do. I would like it if they would do the same via ssh so you immediately know someone had access before you.

I think it is the best solution because it makes you immediately notice that you might not actually want anybody to login without any password at all. And any other method has worse trade offs.

Re: A security update for the Raspberry Pi

#17

Post by b101010 »

jcriddle4 wrote: post #9

I wonder if instead they could setup a fake or jailed SSH that would let you login, it would then display helpful info about how to really enable SSH and then it would kick you out?

part of this can be done with openSSH by setting the banner option in sshd_config.

"Banner The contents of the specified file are sent to the remote user before authentication is allowed. If the argument is ``none'' then no banner is displayed. By default, no banner is displayed."

Re: A security update for the Raspberry Pi

#18

Post by digitalsushi »

falcolas wrote: post #15
jcriddle4 wrote: post #9

I wonder if instead they could setup a fake or jailed SSH that would let you login, it would then display helpful info about how to really enable SSH and then it would kick you out?

Given that you can specify a "shell" on SSH login, it's definitely possible.

To people who might experiment with this: Be careful! A teenager me, two decades ago, changed the shell of a system account to a joke program, and I didn't know they could suspend that joke and grab a system subshell. Then again, learning one the hard way every now and then is a great way to boost your working memory.

Re: A security update for the Raspberry Pi

#19

Post by digitalsushi »

tym0 wrote: post #10

Isn't it a bit overkill? it's not like you can access them from the internet if they're on the local network. No?

I think this change isn't really so much to improve security, as to shift the blame from them, to the owner. And I think I'd do the same thing if I were them.

Edit: we should remember IPv6 is becoming a real thing, too. If I scan my web logs, see a pi in there, with v6, I might just try to ssh into it as the pi:raspberry user. Maybe I dont even need to decide it's a pi, just try it anyways.

Post reply on HN