RdlP
Posts: 5
Joined: Sun Sep 22, 2013 5:35 pm

Raspberry password is change automatically

Thu Aug 03, 2017 8:32 pm

Hello,

I have a problem with my raspberry pi (with raspbian). I flash the SD and enable SSH and I can enter in the raspberry pi via SSH. The problem is that after some time (eg: 8 hours) I can't connect with raspberry pi through SSH:

Code: Select all

ssh pi@192.168.1.113
pi@192.168.1.113's password: 
Permission denied, please try again.
pi@192.168.1.113's password: 
Permission denied, please try again.
pi@192.168.1.113's password: 
Permission denied (publickey,password).
I try to connect raspberry pi to a TV (with a HDMI wire) and try to change password with "passwd" command but when it ask for my current password it fails.

So, I supposed that the password is changed but I have not changed the password. The installation is a fresh installation and this problem has happen to me many times with this raspberry pi.

What is happend? anybody knows?

User avatar
DougieLawson
Posts: 36130
Joined: Sun Jun 16, 2013 11:19 pm
Location: Basingstoke, UK
Contact: Website Twitter

Re: Raspberry password is change automatically

Thu Aug 03, 2017 8:35 pm

The password doesn't change until you use the passwd command, or choose the option from the RPi settings menu or choose the option from raspi-config.
Note: Having anything humorous in your signature is completely banned on this forum. Wear a tin-foil hat and you'll get a ban.

Any DMs sent on Twitter will be answered next month.

This is a doctor free zone.

jamesh
Raspberry Pi Engineer & Forum Moderator
Raspberry Pi Engineer & Forum Moderator
Posts: 23682
Joined: Sat Jul 30, 2011 7:41 pm

Re: Raspberry password is change automatically

Thu Aug 03, 2017 8:57 pm

Is the device exposed to the internet? Do you change the password before using SSH?
Principal Software Engineer at Raspberry Pi (Trading) Ltd.
Contrary to popular belief, humorous signatures are allowed. Here's an example...
"My grief counseller just died, luckily, he was so good, I didn't care."

Frederk
Posts: 27
Joined: Wed Aug 02, 2017 8:56 pm

Re: Raspberry password is change automatically

Thu Aug 03, 2017 9:29 pm

Try

Code: Select all

sudo passwd pi
and then enter a new password

RdlP
Posts: 5
Joined: Sun Sep 22, 2013 5:35 pm

Re: Raspberry password is change automatically

Thu Aug 03, 2017 11:07 pm

DougieLawson wrote:
Thu Aug 03, 2017 8:35 pm
The password doesn't change until you use the passwd command, or choose the option from the RPi settings menu or choose the option from raspi-config.
Yes, I know it (like other linux) but the only thing that I do in the raspberry is comple the webkitgtk library (that take many time). For example, before go to the bed I let compiling webkitgtk in the raspberry and when I wake up and try to connect raspberry through ssh it fails. Nothing more I do.

Because I suffer this problem several times after a fresh raspbian installation I had stored in other PC /etc/shadow and /etc/passwd files. and the last time that the problem occurs I replace the raspberry files with the bacup files but raspberry doesn't let connect through SSH either.
jamesh wrote: Is the device exposed to the internet? Do you change the password before using SSH?
the raspberry has internet connection but it is behind a router and the router hasn't redirect to the raspberry. The password is the default password ("raspberry")

asandford
Posts: 1997
Joined: Mon Dec 31, 2012 12:54 pm
Location: Waterlooville

Re: Raspberry password is change automatically

Fri Aug 04, 2017 12:25 am

At the login prompt, type the password instead of the userid to ensure the keyboard / lang / something else hasn't changed what you think you are entering (although this is normally a problem with special chars and/or you aren't using a UK qwerty keyboard).

RdlP
Posts: 5
Joined: Sun Sep 22, 2013 5:35 pm

Re: Raspberry password is change automatically

Fri Aug 04, 2017 6:40 am

Frederk wrote:
Thu Aug 03, 2017 9:29 pm
Try

Code: Select all

sudo passwd pi
and then enter a new password
With this command I can reset the password to "raspberry" and now I can enter through SSH. I tried with "passwd" command, without sudo and it didn't work. With sudo it works.
Martin Frezman wrote: How come no pointers to "The Boot Sticky"?

Isn't this all covered in "The Boot Sticky" ?
I think this is not a boot problem, my raspberry pi boot and if I connect to TV I can use the system (because the raspberry pi doesn't ask for the password at startup)

Now, I can enter again to the system (changing the password with sudo passwd pi). The question now I Why the password was changed :?

arezki
Posts: 2
Joined: Wed Jan 10, 2018 1:46 pm

Re: Raspberry password is change automatically

Wed Jan 10, 2018 1:49 pm

Hi,

I got the same problem and I would be very interested to know why it happened.
FYI, my raspberry was connected to the Internet...

arezki
Posts: 2
Joined: Wed Jan 10, 2018 1:46 pm

Re: Raspberry password is change automatically

Wed Jan 10, 2018 1:52 pm

Hi,

I got the same problem and I would be interested to know why such a thing has happened. Is this a hack do you think ?
My Rpi was connected to the Internet...

jbudd
Posts: 989
Joined: Mon Dec 16, 2013 10:23 am

Re: Raspberry password is change automatically

Wed Jan 10, 2018 8:59 pm

My Rpi was connected to the Internet...
If the password changed and you didn't do it, someone else must have, surely.

Accessing the Internet from the Pi, eg browsing the web is one thing, but allowing the Internet to access your Pi is another thing entirely.
Normally it involves giving the Pi a static IP address, maybe by reserving the address in your router, and opening a port for incoming connections.

With ssh, if you open port 22, it doesn't take many minutes before you see attempts to login. They show up as lines in /var//log/auth.log like this:
Failed password for root from <ip address>
Various login id's are tried and you can guarantee that the first password tried for user pi will be raspberry.
No doubt attacks through other common ports are equally frequent.

Of course, adding a Pi to your network is no more dangerous than any other device - an IOT "smart" gadget for instance, or a mobile phone app.

harvy
Posts: 92
Joined: Mon Nov 26, 2012 1:49 pm
Location: London - UK

Re: Raspberry password is change automatically

Wed Jan 10, 2018 9:18 pm

I've just had the same on one of my four pi's today - some time around mid day GMT...
The pi is NOT internet facing - its behind my router, and only openvpn port to another device...

nothing in bash_history for pi user.
default ssh port is not 22, and pi user is not default.

but meanwhile pi is running (cron jobs for the pi user are still executing, and a web service is still available on my local lan), but i have no access to the device from command line...
Possible bug somewhere?

wira
Posts: 1
Joined: Sun Apr 29, 2018 11:32 am

Re: Raspberry password is change automatically

Sun Apr 29, 2018 11:47 am

I have found the same situation. I have tried to reset password but every time to reboot the password has changed to the fix value which I don't know why. Below is the encrypted that show every time rebooted.


pi:$6$vGkGPKUr$heqvOhUzvbQ66Nb0JGCijh/81sG1WACcZgzPn8A0Wn58hHXWqy5yOgTlYJEbOjhkHD0MRsAkfJgjU/ioCYDeR1:17650:0:99999:7:::

jamesh
Raspberry Pi Engineer & Forum Moderator
Raspberry Pi Engineer & Forum Moderator
Posts: 23682
Joined: Sat Jul 30, 2011 7:41 pm

Re: Raspberry password is change automatically

Sun Apr 29, 2018 1:09 pm

wira wrote:
Sun Apr 29, 2018 11:47 am
I have found the same situation. I have tried to reset password but every time to reboot the password has changed to the fix value which I don't know why. Below is the encrypted that show every time rebooted.


pi:$6$vGkGPKUr$heqvOhUzvbQ66Nb0JGCijh/81sG1WACcZgzPn8A0Wn58hHXWqy5yOgTlYJEbOjhkHD0MRsAkfJgjU/ioCYDeR1:17650:0:99999:7:::
I suspect this is a different issue to that in the thread - please start a new topic, and put more detail in about what happened, and how you tried to change the password.
Principal Software Engineer at Raspberry Pi (Trading) Ltd.
Contrary to popular belief, humorous signatures are allowed. Here's an example...
"My grief counseller just died, luckily, he was so good, I didn't care."

brooc
Posts: 61
Joined: Mon Jun 03, 2013 2:30 pm

Re: Raspberry password is change automatically

Tue Feb 26, 2019 3:18 pm

This has happened to me too.
I realize this sounds crazy and it would to me too if I were reading someone else's post.

The reality is that my router does NOT forward port 22 to the Pi and I just ran a port scan on my IP and it doesn't seem my router has any open ports.

Yet, the RPi's password has changed from the default and I cannot log in.

How would I go about changing my password so I can log in again without having to connect to a monitor or format the SD card?

User avatar
DougieLawson
Posts: 36130
Joined: Sun Jun 16, 2013 11:19 pm
Location: Basingstoke, UK
Contact: Website Twitter

Re: Raspberry password is change automatically

Wed Feb 27, 2019 12:34 am

You'll need another SDCard and a USB SDCard reader.

Get a copy of Raspbian on the new card and boot that. Set a strong known password for pi on the new card.

Insert the borken card in the reader, insert the reader in your RPi.

Edit /etc/shadow and copy the line for pi. Edit /media/pi/etc/shadow and paste in the copied line to replace the line for pi. You will need sudo to do that.

Shutdown, swap cards and reboot.
Note: Having anything humorous in your signature is completely banned on this forum. Wear a tin-foil hat and you'll get a ban.

Any DMs sent on Twitter will be answered next month.

This is a doctor free zone.

brett.daw
Posts: 1
Joined: Tue Jun 25, 2019 8:18 am

Re: Raspberry password is change automatically

Tue Jun 25, 2019 8:27 am

My raspberry pi was also compromised. I admit that I did not change my username/password from its default configuration of pi and raspberry. This was never a problem until I exposed it to the internet for some testing and forgot to stop forwarding port 22 to my raspberry pi. To make a long story short, I googled the unique hash that the password kept changing to and discovered a really good write-up on a piece of malware that they classify as a crypto-mining trojan script. This script not only repopulates itself on every boot-up with the /etc/rc.local , but also adds keys to the authorized keys for the root ssh account, spreads to other raspberry pis, and deletes other crypto mining software. Please visit the following URL for more information on what it does, so you can remove this nasty trojan script: https://malware.news/t/code-analysis-of ... ware/30325

Return to “Troubleshooting”