Root access over SSH enabled by default

[gibby]

Hi all,

I just wanted to mention a security issue I noticed today when I finally got to play with my new PBP.
It appears that SSH is enabled on startup, and that root access via ssh enabled by default.

With the default un/pw being root/root, this is definitely not recommended.

For those not familiar, you can simply issue this command from another linux machine:
ssh {your PBP ip address here} -l root

Once logged in as root (either remotely or locally) you can modify your ssh config:
vi /etc/ssh/sshd_config

On line 32, you will see:
PermitRootLogin yes

Change to:
PermitRootLogin no

Save the changes to sshd_config

If you are doing this remotely, close the session by issuing:

exit

Open a terminal locally on your PBP and restart the ssh service:
sudo systemctl stop sshd
sudo systemctl start sshd

Now if you try to ssh directly to the root account, you will be denied, however, you can sudo your way to root from a sudoers account.

If you don't use ssh normally, you can disable automatic sshd startup:
sudo systemctl disable sshd

If you have disabled ssh on startup, you will have to start it manually to use it:
sudo service ssh start

I would suggest you change the password for both root and your standard user. Make them strong 
I would also suggest that if you're going to run around with SSH enabled, you create a separate non-sudoer user for use with ssh, and deny ssh access to your sudoer accounts (unless you really need that level of remote control).

I'm really enjoying this little machine so far.

Cheers!

[Eggmonkey]

Great post Gibby.
I'm certain I would have forgotten to check this for a few weeks or months.
I'll bookmark this and check all services running with systemctl when my pinebook arrives.

[jiapei100]

Hi all,

I just wanted to mention a security issue I noticed today when I finally got to play with my new PBP.
It appears that SSH is enabled on startup, and that root access via ssh enabled by default.

With the default un/pw being root/root, this is definitely not recommended.

For those not familiar, you can simply issue this command from another linux machine:
ssh {your PBP ip address here} -l root

Once logged in as root (either remotely or locally) you can modify your ssh config:
vi /etc/ssh/sshd_config

On line 32, you will see:
PermitRootLogin yes

Change to:
PermitRootLogin no

Save the changes to sshd_config

If you are doing this remotely, close the session by issuing:

exit

Open a terminal locally on your PBP and restart the ssh service:
sudo systemctl stop sshd
sudo systemctl start sshd

Now if you try to ssh directly to the root account, you will be denied, however, you can sudo your way to root from a sudoers account.

If you don't use ssh normally, you can disable automatic sshd startup:
sudo systemctl disable sshd

If you have disabled ssh on startup, you will have to start it manually to use it:
sudo service ssh start

I would suggest you change the password for both root and your standard user. Make them strong 
I would also suggest that if you're going to run around with SSH enabled, you create a separate non-sudoer user for use with ssh, and deny ssh access to your sudoer accounts (unless you really need that level of remote control).

I'm really enjoying this little machine so far.

Cheers!

It looks my pinephone does NOT come with SSH enabled?

[Arwen]

One other thing, the original Debian did not create, (or re-generate), the SSH host keys on first boot. Looks like it used the host keys from the distribution. This should not be done. All SSH host keys should be unique per computer. It's part of SSH's security.

I wrote a tutorial page about "hardening" your Pinebook Pro, which included re-generating the SSH host keys here;

Hardening your Pinebook Pro software