This is getting ridiculous!
Once upon a time one just copied an image to a card, enabled ssh and
hey presto, you could log in as user pi with password raspberry.
No chance now.
I would point out that I'm not, in general, a complete numpty. I've
been using Pis (and other similar things) for many many years.
So, having found out why the above simple approach doesn't work I have tried:-
Use rpi-imager, wasted first attempt because it wasn't obvious where
one entered user/password. Second attempt seemed to boot the Pi
OK but it never appeared on my LAN so not much help there. (At
least my first dd copied image appeared on the LAN)
Manually editing userconf.txt with my /etc/shadow encrypted
password from my Linux box got to a login prompt but the password
is somehow wrong.
Finally I managed to get a login working by creating a
~/.ssh/authorized keys file with the public key from my Linux
system in it. Phew!
This is getting ridiculous!
Once upon a time one just copied an image to a card, enabled ssh and
hey presto, you could log in as user pi with password raspberry.
No chance now.
I would point out that I'm not, in general, a complete numpty. I've
been using Pis (and other similar things) for many many years.
So, having found out why the above simple approach doesn't work I have tried:-
Use rpi-imager, wasted first attempt because it wasn't obvious where
one entered user/password. Second attempt seemed to boot the Pi
OK but it never appeared on my LAN so not much help there. (At
least my first dd copied image appeared on the LAN)
Manually editing userconf.txt with my /etc/shadow encrypted
password from my Linux box got to a login prompt but the password
is somehow wrong.
Finally I managed to get a login working by creating a
~/.ssh/authorized keys file with the public key from my Linux
system in it. Phew!
On 1/26/25 04:42, Chris Green wrote:
This is getting ridiculous!
Once upon a time one just copied an image to a card, enabled ssh and
hey presto, you could log in as user pi with password raspberry.
No chance now.
I would point out that I'm not, in general, a complete numpty. I've
been using Pis (and other similar things) for many many years.
So, having found out why the above simple approach doesn't work I have tried:-
Use rpi-imager, wasted first attempt because it wasn't obvious where
one entered user/password. Second attempt seemed to boot the Pi
OK but it never appeared on my LAN so not much help there. (At
least my first dd copied image appeared on the LAN)
Manually editing userconf.txt with my /etc/shadow encrypted
password from my Linux box got to a login prompt but the password
is somehow wrong.
Finally I managed to get a login working by creating a
~/.ssh/authorized keys file with the public key from my Linux
system in it. Phew!
I can offer some suggestions: use version 1.85 of the Imager program.
It has solved some of the password entry issues of the older version.
Also it allows you to use a different user name than pi, but I like pi
so I use it. Use the latest Raspberry Pi OS, either 64 or 32 bit as appropriate.
Is there **really** such a big security issue with default login names
and passwords on Raspberry Pis? Surely almost all of them are going
to be on home networks behind NAT routers and also surely no one is
going to (without thinking about it a bit!) put confidential data on
one.
Chris Green wrote:
Is there **really** such a big security issue with default login names
and passwords on Raspberry Pis? Surely almost all of them are going
to be on home networks behind NAT routers and also surely no one is
going to (without thinking about it a bit!) put confidential data on
one.
Plenty of Pis (especially the compute modules) end-up in industrial kit, maybe not much data on them, but you don't want them being used to
laterally attack other systems.
<https://www.legislation.gov.uk/uksi/2023/1007/schedule/1/paragraph/1/made>
"Passwords must be—
(a)unique per product; or
(b)defined by the user of the product."
Is there **really** such a big security issue with default login names
and passwords on Raspberry Pis? Surely almost all of them are going
to be on home networks behind NAT routers and also surely no one is
going to (without thinking about it a bit!) put confidential data on
one. Anyone installing any system which is going to be directly out
on the internet should be very aware of the risks and will do what's required.
On 1/26/25 12:20, Chris Green wrote:
Is there **really** such a big security issue with default login names
and passwords on Raspberry Pis? Surely almost all of them are going
to be on home networks behind NAT routers and also surely no one is
going to (without thinking about it a bit!) put confidential data on
one. Anyone installing any system which is going to be directly out
on the internet should be very aware of the risks and will do what's
required.
I don't know but there appear to be a few people who can't get their password into their Pi successfully.
On 26/01/2025 20:37, Knute Johnson wrote:
I don't know but there appear to be a few people who can't get their
password into their Pi successfully.
Most who cannot are people trying to use a foreign keyboard, which you cannot set up in the imager
On 1/26/25 16:52, Chris Townley wrote:
On 26/01/2025 20:37, Knute Johnson wrote:
I don't know but there appear to be a few people who can't get their
password into their Pi successfully.
Most who cannot are people trying to use a foreign keyboard, which you
cannot set up in the imager
There was a lot of back and forth about that on the Pi Forum last year.
I and several other folks suggested that it would be a good idea to be
able set your keyboard type in the Imager. And since I have one of
those foreign (the default is en_UK) keyboards it can be tricky until
you figure out what is going on.
Andy Burns <usenet@andyburns.uk> wrote:
Chris Green wrote:
Is there **really** such a big security issue with default login names
and passwords on Raspberry Pis? Surely almost all of them are going
to be on home networks behind NAT routers and also surely no one is
going to (without thinking about it a bit!) put confidential data on
one.
Plenty of Pis (especially the compute modules) end-up in industrial kit,
maybe not much data on them, but you don't want them being used to
laterally attack other systems.
<https://www.legislation.gov.uk/uksi/2023/1007/schedule/1/paragraph/1/made> >>
"Passwords must be—
(a)unique per product; or
(b)defined by the user of the product."
Ah, so it's legislation has caused this. :-)
Again I say, anyone who is actually deploying Pis in such a situation
needs to know what they're doing. If they don't know what they're
doing no amount of legislation is going to help much.
What really is getting to me is that the non-GUI user who wants to use
a Pi (or arduino or BBB) to moinitor the temperature in his garage
ends up having to jumpo through lots of unnecessary hoops to do it. To
a significant extent it's because the Pi has become much more 'mass
market'.
Oh well, I guess I can live with it. Rant over. :-)
On 26/01/2025 20:37, Knute Johnson wrote:
On 1/26/25 12:20, Chris Green wrote:
Is there **really** such a big security issue with default login names
and passwords on Raspberry Pis? Surely almost all of them are going
to be on home networks behind NAT routers and also surely no one is
going to (without thinking about it a bit!) put confidential data on
one. Anyone installing any system which is going to be directly out
on the internet should be very aware of the risks and will do what's
required.
I don't know but there appear to be a few people who can't get their
password into their Pi successfully.
Most who cannot are people trying to use a foreign keyboard, which you cannot set up in the imager
An RPi is overkill for a job like that.
An ESP32 or Arduino will keep things simple at far lower cost.
What really is getting to me is that the non-GUI user who wants to use
a Pi (or arduino or BBB) to moinitor the temperature in his garage
An RPi is overkill for a job like that.
An ESP32 or Arduino will keep things simple at far lower cost.
On 27/01/2025 06:35, Bob Martin wrote:
An RPi is overkill for a job like that.
An ESP32 or Arduino will keep things simple at far lower cost.
Or a Pi Pico W. Cheaper than an Arduino, networks, has 3 ADC S. Its perfect
Bob Martin <bob.martin@excite.com> wrote:
But a Pi is much more accessible (in the sense of being easy to access
What really is getting to me is that the non-GUI user who wants to use
a Pi (or arduino or BBB) to moinitor the temperature in his garage
An RPi is overkill for a job like that.
An ESP32 or Arduino will keep things simple at far lower cost.
your data directly). It's just so much handier to communicate with,
as in the case of my Pi running on a boat in France, it does all the
work of connecting and so on as well as collecting data. In my case
it also drives two displays.
... and it's not exactly expensive, £33 for a 1GB 4B and a lot less if
you go for a Pi Zero.
I do have a couple of Arduinos and ESP32s but given that you really
need another computer to access them and do anything useful with the
data I always end up deciding that a Pi (or a BeagleBone Black) is
just so much easier as a standalone system.
Is there **really** such a big security issue with default login names
and passwords on Raspberry Pis? Surely almost all of them are going
to be on home networks behind NAT routers and also surely no one is
going to (without thinking about it a bit!) put confidential data on
one. Anyone installing any system which is going to be directly out
on the internet should be very aware of the risks and will do what's required.
On 26/01/2025 at 18:20, Chris Green wrote:
Is there **really** such a big security issue with default login names
and passwords on Raspberry Pis? Surely almost all of them are going
to be on home networks behind NAT routers and also surely no one is
going to (without thinking about it a bit!) put confidential data on
one. Anyone installing any system which is going to be directly out
on the internet should be very aware of the risks and will do what's
required.
This, exactly.
Yet another example of 'we know better than you' and 'make it easier for (some unknown version of) everyone'
On 27/01/2025 08:57, Chris Green wrote:
Bob Martin <bob.martin@excite.com> wrote:
But a Pi is much more accessible (in the sense of being easy to access
What really is getting to me is that the non-GUI user who wants to use >>> a Pi (or arduino or BBB) to moinitor the temperature in his garage
An RPi is overkill for a job like that.
An ESP32 or Arduino will keep things simple at far lower cost.
your data directly). It's just so much handier to communicate with,
as in the case of my Pi running on a boat in France, it does all the
work of connecting and so on as well as collecting data. In my case
it also drives two displays.
... and it's not exactly expensive, £33 for a 1GB 4B and a lot less if
you go for a Pi Zero.
I do have a couple of Arduinos and ESP32s but given that you really
need another computer to access them and do anything useful with the
data I always end up deciding that a Pi (or a BeagleBone Black) is
just so much easier as a standalone system.
My organically growing network uses Picos to collect the data and a Pi
Zero to receive it and display it and do what is needful with it.
On 26/01/2025 22:52, Chris Townley wrote:
On 26/01/2025 20:37, Knute Johnson wrote:Why would you be using a keyboard at all on a headless Pi?
On 1/26/25 12:20, Chris Green wrote:
Is there **really** such a big security issue with default login names >>>> and passwords on Raspberry Pis? Surely almost all of them are going
to be on home networks behind NAT routers and also surely no one is
going to (without thinking about it a bit!) put confidential data on
one. Anyone installing any system which is going to be directly out
on the internet should be very aware of the risks and will do what's
required.
I don't know but there appear to be a few people who can't get their
password into their Pi successfully.
Most who cannot are people trying to use a foreign keyboard, which you
cannot set up in the imager
On 26/01/2025 at 18:20, Chris Green wrote:
Is there **really** such a big security issue with default login names
and passwords on Raspberry Pis? Surely almost all of them are going
to be on home networks behind NAT routers and also surely no one is
going to (without thinking about it a bit!) put confidential data on
one. Anyone installing any system which is going to be directly out
on the internet should be very aware of the risks and will do what's
required.
This, exactly.
Yet another example of 'we know better than you' and 'make it easier for (some unknown version of) everyone'
My main memory is the rPi imager also allowed headless Wifi set up,I think it did.
which had not be possible/easy previously. I can't remember if it worked?
The Natural Philosopher <tnp@invalid.invalid> wrote:
On 27/01/2025 08:57, Chris Green wrote:Well my boat's system uses just an ancient Pi B+ and I2C to collect
Bob Martin <bob.martin@excite.com> wrote:
But a Pi is much more accessible (in the sense of being easy to access
What really is getting to me is that the non-GUI user who wants to use >>>>> a Pi (or arduino or BBB) to moinitor the temperature in his garage
An RPi is overkill for a job like that.
An ESP32 or Arduino will keep things simple at far lower cost.
your data directly). It's just so much handier to communicate with,
as in the case of my Pi running on a boat in France, it does all the
work of connecting and so on as well as collecting data. In my case
it also drives two displays.
... and it's not exactly expensive, £33 for a 1GB 4B and a lot less if
you go for a Pi Zero.
I do have a couple of Arduinos and ESP32s but given that you really
need another computer to access them and do anything useful with the
data I always end up deciding that a Pi (or a BeagleBone Black) is
just so much easier as a standalone system.
My organically growing network uses Picos to collect the data and a Pi
Zero to receive it and display it and do what is needful with it.
all the data, no other microcontrollers or anything.
On 27/01/2025 08:49, The Natural Philosopher wrote:
On 26/01/2025 22:52, Chris Townley wrote:
On 26/01/2025 20:37, Knute Johnson wrote:Why would you be using a keyboard at all on a headless Pi?
On 1/26/25 12:20, Chris Green wrote:
Is there **really** such a big security issue with default login names >>>>> and passwords on Raspberry Pis? Surely almost all of them are going >>>>> to be on home networks behind NAT routers and also surely no one is
going to (without thinking about it a bit!) put confidential data on >>>>> one. Anyone installing any system which is going to be directly out >>>>> on the internet should be very aware of the risks and will do what's >>>>> required.
I don't know but there appear to be a few people who can't get their
password into their Pi successfully.
Most who cannot are people trying to use a foreign keyboard, which
you cannot set up in the imager
Clearly to access the Pi from another computer. Running headless doesn't mean you don't way to access it
On 27/01/2025 12:29, Chris Green wrote:
The Natural Philosopher <tnp@invalid.invalid> wrote:
On 27/01/2025 08:57, Chris Green wrote:Well my boat's system uses just an ancient Pi B+ and I2C to collect
Bob Martin <bob.martin@excite.com> wrote:
But a Pi is much more accessible (in the sense of being easy to access >>> your data directly). It's just so much handier to communicate with,
What really is getting to me is that the non-GUI user who wants to use >>>>> a Pi (or arduino or BBB) to moinitor the temperature in his garage
An RPi is overkill for a job like that.
An ESP32 or Arduino will keep things simple at far lower cost.
as in the case of my Pi running on a boat in France, it does all the
work of connecting and so on as well as collecting data. In my case
it also drives two displays.
... and it's not exactly expensive, £33 for a 1GB 4B and a lot less if >>> you go for a Pi Zero.
I do have a couple of Arduinos and ESP32s but given that you really
need another computer to access them and do anything useful with the
data I always end up deciding that a Pi (or a BeagleBone Black) is
just so much easier as a standalone system.
My organically growing network uses Picos to collect the data and a Pi
Zero to receive it and display it and do what is needful with it.
all the data, no other microcontrollers or anything.
Really? What is on the end of the iI2C lines then?
Various things, for example several I2C temperature and humidity sensors, some I2C A2D converters, etc.Well my boat's system uses just an ancient Pi B+ and I2C to collectReally? What is on the end of the iI2C lines then?
all the data, no other microcontrollers or anything.
On 27/01/2025 14:24, Chris Green wrote:
Various things, for example several I2C temperature and humidity sensors, some I2C A2D converters, etc.Well my boat's system uses just an ancient Pi B+ and I2C to collectReally? What is on the end of the iI2C lines then?
all the data, no other microcontrollers or anything.
And you think that none of these are, or contain, 'microcontrollers'?
My main memory is the rPi imager also allowed headless Wifi set up,
which had not be possible/easy previously. I can't remember if it worked?
Pancho <Pancho.Jones@proton.me> wrote:
My main memory is the rPi imager also allowed headless Wifi set up,
which had not be possible/easy previously. I can't remember if it worked?
WiFi is/was configured in wpa_supplicant.txt, and that worked fine
without the RPi imager program.
On 28/01/2025 06:14, Computer Nerd Kev wrote:
Pancho <Pancho.Jones@proton.me> wrote:Was...
My main memory is the rPi imager also allowed headless Wifi set up,
which had not be possible/easy previously. I can't remember if it
worked?
WiFi is/was configured in wpa_supplicant.txt, and that worked fine
without the RPi imager program.
All change with bookworm IIRC
On 28/01/2025 08:51, The Natural Philosopher wrote:
On 28/01/2025 06:14, Computer Nerd Kev wrote:
Pancho <Pancho.Jones@proton.me> wrote:Was...
My main memory is the rPi imager also allowed headless Wifi set up,
which had not be possible/easy previously. I can't remember if it
worked?
WiFi is/was configured in wpa_supplicant.txt, and that worked fine
without the RPi imager program.
All change with bookworm IIRC
UK law: Product Security and Telecommunications Security Act 2022 which
is amongst things, designed to stop devices, like routers for example,
from having default passwords that can easily be guessed. That's because many people leave the passwords at the default settings and then such devices are more easily roped into DDOS attacks.
I can offer some suggestions: use version 1.85 of the Imager program.
It has solved some of the password entry issues of the older version.
Also it allows you to use a different user name than pi, but I like pi
so I use it. Use the latest Raspberry Pi OS, either 64 or 32 bit as appropriate.
Is there **really** such a big security issue with default login names
and passwords on Raspberry Pis? Surely almost all of them are going
to be on home networks behind NAT routers and also surely no one is
going to (without thinking about it a bit!) put confidential data on
one. Anyone installing any system which is going to be directly out
on the internet should be very aware of the risks and will do what's required.
On 2025-01-26, Chris Green <cl@isbd.net> wrote:
Is there **really** such a big security issue with default login names
and passwords on Raspberry Pis? Surely almost all of them are going
to be on home networks behind NAT routers and also surely no one is
going to (without thinking about it a bit!) put confidential data on
one. Anyone installing any system which is going to be directly out
on the internet should be very aware of the risks and will do what's
required.
Probably not. People installing special-purpose distributions (media
player, dns filtering, hoem automazion etc.) may not even be aware that they need to change the SSH password when they only interact with some web frontend.
Also, it is not just the data on the device that is at risk. There is also the risk that such an exposed machine will be used as part of a botnet to attack other machines.
A quick check on shodan shows 86362 hits for "ssh raspbian". If only a small percentage of these use the default password, that is way too much.
cu
Michael
A quick check on shodan shows 86362 hits for "ssh raspbian". If only a small >> percentage of these use the default password, that is way too much.But ssh is not enabled by default in Raspbian.
On 28/01/2025 06:14, Computer Nerd Kev wrote:
Pancho <Pancho.Jones@proton.me> wrote:Was...
My main memory is the rPi imager also allowed headless Wifi set up,WiFi is/was configured in wpa_supplicant.txt, and that worked fine
which had not be possible/easy previously. I can't remember if it worked? >>
without the RPi imager program.
All change with bookworm IIRC
mm0fmf <none@invalid.com> wrote:
On 28/01/2025 08:51, The Natural Philosopher wrote:
On 28/01/2025 06:14, Computer Nerd Kev wrote:
Pancho <Pancho.Jones@proton.me> wrote:Was...
My main memory is the rPi imager also allowed headless Wifi set up,
which had not be possible/easy previously. I can't remember if it
worked?
WiFi is/was configured in wpa_supplicant.txt, and that worked fine
without the RPi imager program.
All change with bookworm IIRC
UK law: Product Security and Telecommunications Security Act 2022 which
is amongst things, designed to stop devices, like routers for example,
from having default passwords that can easily be guessed. That's because
many people leave the passwords at the default settings and then such
devices are more easily roped into DDOS attacks.
Also the California Senate Bill 327:
"(b) Subject to all of the requirements of subdivision (a), if a connected device is equipped with a means for authentication outside a local area network, it shall be deemed a reasonable security feature under subdivision (a) if either of the following requirements are met:
(1) The preprogrammed password is unique to each device manufactured.
(2) The device contains a security feature that requires a user to generate
a new means of authentication before access is granted to the device for the first time. "
https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201720180SB327
The Natural Philosopher <tnp@invalid.invalid> wrote:
On 28/01/2025 06:14, Computer Nerd Kev wrote:
Pancho <Pancho.Jones@proton.me> wrote:Was...
My main memory is the rPi imager also allowed headless Wifi set up,WiFi is/was configured in wpa_supplicant.txt, and that worked fine
which had not be possible/easy previously. I can't remember if it worked? >>>
without the RPi imager program.
All change with bookworm IIRC
Sounds like I got off the RPiOS ship just at the right time before
they went completely nuts. Choice of distros is such a wonderful
advantage of Linux (even if there's less choice for the Pis than
for PC).
Well I stick to PIOS simple because it is the documented standard. Networking is handled by the Network Manager and it gets tricky to set
that up without a console screen/keyboard at least - but there is a
great utility called nmcli I think that 'does everything' once you have learnt its magic spells.
To be honest although it is possible to do everything over ssh, the
chances of losing connectivity while messing with the network are high
and a HDMI screen and a USB keyboard are not hard to rig up with the appropiate adapters.
Well I stick to PIOS simple because it is the documented standard. >Networking is handled by the Network Manager and it gets tricky to set
that up without a console screen/keyboard at least - but there is a
great utility called nmcli I think that 'does everything' once you have >learnt its magic spells.
In article <vnbqo3$21n98$4@dont-email.me>,
The Natural Philosopher <tnp@invalid.invalid> wrote:
Well I stick to PIOS simple because it is the documented standard.
Networking is handled by the Network Manager and it gets tricky to set
that up without a console screen/keyboard at least - but there is a
great utility called nmcli I think that 'does everything' once you have
learnt its magic spells.
There's also nmtui, which works in the same places nmcli does, but is much easier to navigate.
On 29/01/2025 21:14, Scott Alfter wrote:
In article <vnbqo3$21n98$4@dont-email.me>,Indeed yes. Does it cover all the options? I never got around to using
The Natural Philosopher <tnp@invalid.invalid> wrote:
Well I stick to PIOS simple because it is the documented standard.
Networking is handled by the Network Manager and it gets tricky to set
that up without a console screen/keyboard at least - but there is a
great utility called nmcli I think that 'does everything' once you have
learnt its magic spells.
There's also nmtui, which works in the same places nmcli does, but is much >> easier to navigate.
it. My configuration was nicely handled by nmcli...
On 2025-01-26, Chris Green <cl@isbd.net> wrote:
Also, it is not just the data on the device that is at risk. There is also the risk that such an exposed machine will be used as part of a botnet to attack other machines.
| Sysop: | DaiTengu |
|---|---|
| Location: | Appleton, WI |
| Users: | 1,015 |
| Nodes: | 10 (0 / 10) |
| Uptime: | 67:25:42 |
| Calls: | 13,252 |
| Files: | 186,574 |
| D/L today: |
190 files (67,839K bytes) |
| Messages: | 3,335,403 |