31–38 of 38 posts
I wonder if instead they could setup a fake or jailed SSH that would let you login, it would then display helpful info about how to really enable SSH and then it would kick you out?
part of this can be done with openSSH by setting the banner option in sshd_config. "Banner The contents of the specified file are sent to the remote user before authentication is allowed. If the argument is ``none'' then no banner is displayed. By default, no banner is displayed."
Isn't it a bit overkill? it's not like you can access them from the internet if they're on the local network. No?
In an alternate universe where they don't make this change and raspberry pis are included in a massive attack because of their intentionally well-known default root account is listening on a running-by-default sshd, everyone would be screaming about the raspi foundations rampant incompetence.
The only place this will sting is in un-maintained 'how to set up your new raspberry pi's SD card' tutorials.
I believe that most users who want to set up a headless pi can handle this change with no problem.
Earlier quoted context omitted.
...and then deletes the file. -> or just get angry when they reboot and cant get back in without unplugging it from whatever remote location it was plugged into and taking it home to plug into a keyboard mouse and monitor. great for the effort. i did baulk when i first started a pi to find the defaults were so insecure. But I'm not sure the solutions are that helpful. cant we just set a root password on first boot li…
This is for a headless first-boot scenario. - write the file - put the SD card in your pi - it boots with ssh enabled - it deletes the file - SSH in and permanently enable SSH on boot - done It's a bit of a hassle for anyone who knows their way around linux, but Pis are marketed toward kids & other "normals". This is what happens to products designed for everyone.
HHHrrrmpf.
Isn't it a bit overkill? it's not like you can access them from the internet if they're on the local network. No?
I'm interested in whether this will make a meaningful difference, however. It probably would have been nicer if Raspbian required users to put a root password into /boot/password or similar, and then deleted that file on boot -- or mandated that users change their password on first login. My concern with this is that I suspect most tinkerers will press the "make it work" button, drop /boot/ssh in, and never bother changing the password.
Earlier quoted context omitted.
SSH off by default is a change to the image, not an update through apt. I am not sure if this is the case with the warning telling you that you are still using the default password.
I don't run Raspbian OS in my device, so I cannot verify. But reading this created doubt in my mind. > To update your existing Jessie image with all the bug fixes and these new security changes, type the following at the command line: I think better implementation would be asking if one is running their device in public or private network and explaining the consequences while setting up for the first time. We are ask…
Earlier quoted context omitted.
I don't run Raspbian OS in my device, so I cannot verify. But reading this created doubt in my mind. > To update your existing Jessie image with all the bug fixes and these new security changes, type the following at the command line: I think better implementation would be asking if one is running their device in public or private network and explaining the consequences while setting up for the first time. We are ask…
The situation in which you want definitely want SSH enabled on a pi is when you are running it headlessly. This is an incredibly common use case, especially for more experienced users. In such a setup there is no opportunity to ask the user anything.
So this is why my RPi is no longer responding to SSH?