So this is why my RPi is no longer responding to SSH?
A security update for the Raspberry Pi
21–30 of 38 posts
Re: A security update for the Raspberry Pi
#22Earlier quoted context omitted.
Yes this ruins just about every Pi from scratch tutorial. The worst part is if this affects the "lite" distro which is headless. The beauty of using an image like Raspbian Lite was being able to flash, ssh (ip via DHCP), change password/hostname and done.
If you can flash an sd card you can turn on SSH with the new method. All my Pi's are headless, and this is a mild inconvenience at best. Way less inconvenient than the internet falling apart because users don't know anything about security.
New method is what? I sometimes mount the Linux partition if I'm flashing from a Linux PC to edit hostname etc but this is extra hassle especially if using a Mac.
Re: A security update for the Raspberry Pi
#23Isn't it a bit overkill? it's not like you can access them from the internet if they're on the local network. No?
If you have a Pi (or several) on a private network, say, behind a NAT router, there should be no problem either way. I guess a sufficient number of people have put Pis on the Internet, or the recent wave of IoT-DDOS attacks has spooked the Raspberry people sufficiently to make this change.
It feels like a pre-emptive precaution.. I'm sure most people running a Pi at home have no way for their SSHD port to be exposed and if they do set up NAT port forwarding they should look into how to make that more secure.
Re: A security update for the Raspberry Pi
#24I wonder if instead they could setup a fake or jailed SSH that would let you login, it would then display helpful info about how to really enable SSH and then it would kick you out?
You don't even need a jail for that. Just add those lines to the end of /etc/ssh/sshd_config:
Match User pi
AcceptEnv
ForceCommand echo 'To enable SSH, do this and that'
Re: A security update for the Raspberry Pi
#25Though the actual article title and URL state "For Raspbian Pixel" the author replies in the comments that this also applies to Raspbian Jessie Lite.
https://www.raspberrypi.org/blog/a-security-update-for-raspb...
Re: A security update for the Raspberry Pi
#26TL;DR > put a file called ssh in the /boot/ directory with any content to enable SSH which we turned off by default to prevent unauthorized access of your devise in public network. I wonder how many people are going to scratch their head when their headless Raspberry Pi will be unable to connect to their laptop in same way as earlier without this piece of information. I hope running sudo apt-get update, notifies them…
...and then deletes the file.
-> or just get angry when they reboot and cant get back in without unplugging it from whatever remote location it was plugged into and taking it home to plug into a keyboard mouse and monitor.
great for the effort. i did baulk when i first started a pi to find the defaults were so insecure. But I'm not sure the solutions are that helpful. cant we just set a root password on first boot like every other nix distro.
Re: A security update for the Raspberry Pi
#27I wonder if instead they could setup a fake or jailed SSH that would let you login, it would then display helpful info about how to really enable SSH and then it would kick you out?
You don't even need a jail for that. Just add those lines to the end of /etc/ssh/sshd_config: Match User pi AcceptEnv ForceCommand echo 'To enable SSH, do this and that' EDIT: added an explicit empty "AcceptEnv".
Allowing untrusted users to run programs is a recipe for disaster. Forcecommand runs its commands using a login shell that gets a lot of information from the connecting user. It wouldn't be the first time someone found an obscure environment variable that turns this into a remote shell.
Re: A security update for the Raspberry Pi
#28Earlier quoted context omitted.
You don't even need a jail for that. Just add those lines to the end of /etc/ssh/sshd_config: Match User pi AcceptEnv ForceCommand echo 'To enable SSH, do this and that' EDIT: added an explicit empty "AcceptEnv".
Allowing untrusted users to run programs is a recipe for disaster. Forcecommand runs its commands using a login shell that gets a lot of information from the connecting user. It wouldn't be the first time someone found an obscure environment variable that turns this into a remote shell.
[deleted]
Re: A security update for the Raspberry Pi
#29Earlier quoted context omitted.
If you can flash an sd card you can turn on SSH with the new method. All my Pi's are headless, and this is a mild inconvenience at best. Way less inconvenient than the internet falling apart because users don't know anything about security.
New method is what? I sometimes mount the Linux partition if I'm flashing from a Linux PC to edit hostname etc but this is extra hassle especially if using a Mac.
You add a file named ssh to the boot directory. This permanently enables SSH. The boot partition is fat formatted and can be edited on basically any device as a result. It's right in the linked article.
Re: A security update for the Raspberry Pi
#30TL;DR > put a file called ssh in the /boot/ directory with any content to enable SSH which we turned off by default to prevent unauthorized access of your devise in public network. I wonder how many people are going to scratch their head when their headless Raspberry Pi will be unable to connect to their laptop in same way as earlier without this piece of information. I hope running sudo apt-get update, notifies them…
...and then deletes the file. -> or just get angry when they reboot and cant get back in without unplugging it from whatever remote location it was plugged into and taking it home to plug into a keyboard mouse and monitor. great for the effort. i did baulk when i first started a pi to find the defaults were so insecure. But I'm not sure the solutions are that helpful. cant we just set a root password on first boot li…
This is for a headless first-boot scenario.
- write the file
- put the SD card in your pi
- it boots with ssh enabled
- it deletes the file
- SSH in and permanently enable SSH on boot
- done
It's a bit of a hassle for anyone who knows their way around linux, but Pis are marketed toward kids & other "normals". This is what happens to products designed for everyone.