Raspbian Lite: Please have SSH enabled by default

[technoboi]

I cannot see the logic in having to enable SSH on a headless server. It is such a faff having to connect up a monitor and keyboard to enable SSH every time I start with a new install of Raspbian Lite. It should only be necessary to connect up the ethernet and a power supply. If there is some concern that someone might log in, with a monitor connected, and not want SSH enabled, it is perfectly possible to put up a message to this effect on boot up.
So, please can we have SSH enabled by default on Raspbian Lite.

[itsmedoofer]

Hi,

It was deemed a security risk, I can totally see why it was done with the distro having a default user and password.

Have a look here and you will see you can still setup headless, with a minimal amount of extra messing about...

https://www.raspberrypi.org/documentati ... eadless.md

[danjperron]

No! I think ssh by default has to be disabled.
Think about the number of beginners that don't change the password. I don't want a army of ghost Pi doing nasty stuff. I'm sure that it exist already ;-(

N.B> It is simple to add a file name "ssh" in the boot partition to enable the ssh on first boot. Then you ssh on it and do raspi-config to enable it for good.
No need to connect a keyboard and a monitor. I do it all the times.

[jamesh]

So, please can we have SSH enabled by default on Raspbian Lite.

Sorry, we disabled SSH on by default for security reasons, and we won't be turning it back on by default. See previous post for how to set up SSH headless.

Details on why here https://www.raspberrypi.org/blog/a-secu ... ian-pixel/

[HawaiianPi]

Yup, just add an ssh (or ssh.txt) file to the small FAT32 "boot"partition of a Raspbian imaged SD card, which is accessible on Windows and Mac computers. When Raspbian sees that file it will enable SSH and delete the file (SSH will remain enabled unless you manually disable it).

So it's very simple to enable SSH on a completely headless Pi before you even boot it. I've done it several times, as most of mine are headless. Many also had a pre-configured wpa_supplicant.conf file as well, and automatically connect to my WiFi router.

Code: Select all

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1
country=GB

network={
	ssid="Your network SSID"
	psk="Your WPA/WPA2 security key"
	key_mgmt=WPA-PSK
}

Edit country=, ssid= and psk= with your information and save the file.

[jahboater]

So it's very simple to enable SSH on a completely headless Pi before you even boot it.

+1
I do it routinely. If you are in /boot to change config.txt anyway, then the quickest way is simply:

>ssh

4 characters + return.
Works on Linux, MacOS, Windows 10 WSL.

[DougieLawson]

Until Raspbian switches to the Ubuntu / Mint style of setting a userid and password during the install & first boot process then you're stuck.

Having a predefined userid/password with root privileges (through sudo) and SSH enabled is a massive security hole (as we've seen in viewtopic.php?f=66&t=230019 you get about four minutes with SSH port 22 open before your machine WILL be compromised.

The solution is not the junk we've got now that warns you, that you're insecure. The only sane solution is complete removal of the insecure pi userid and ask for userid and a strong password as part of first boot.

On my systems I update the sudoers stuff to require a password. I've even gone the step further with a root password (and sudo configured to use that).

[binaryhermit]

You don't need to become root to do malicious things, just saying.
Root just expands your options for mischief.

As others have said, ssh is staying disabled unless they go to the ubuntu style "no predefined account, set up first account on first boot" model.

[HawaiianPi]

Until Raspbian switches to the Ubuntu / Mint style of setting a userid and password during the install & first boot process then you're stuck.

... ssh is staying disabled unless they go to the ubuntu style "no predefined account, set up first account on first boot" model.

Yes, but that would require a keyboard and screen for the initial installation, so we're back to square one.

It seems the current image file distribution may be the best solution after all.

[fbe]

Instead of looking for an empty ssh file a config file could be used with settings, that otherwise the initial setup would ask for.

[danjperron]

Yes, but that would require a keyboard and screen for the initial installation, so we're back to square one.

Not true!

When you load the O.S. image from your computer to your SDCard. It is a simple task just add a file called "ssh" in the first partition boot. The first partition is available in windows, mac os and linux.


If you have a Linux computer then you could just modify the image before writing your SDCard. This way if you have many cards to burn you need to do it only once!

1 - Download the Image
2 - Unzip the image
3- Get the first partition offset

Code: Select all

daniel@linuxserver:/usr/data/public/RaspberryPi$ sudo fdisk -l 2018-11-13-raspbian-stretch-lite.img

Disk 2018-11-13-raspbian-stretch-lite.img: 1.8 GiB, 1866465280 bytes, 3645440 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x7ee80803

Device                                Boot Start     End Sectors  Size Id Type
2018-11-13-raspbian-stretch-lite.img1       8192   98045   89854 43.9M  c W95 FAT32 (LBA)
2018-11-13-raspbian-stretch-lite.img2      98304 3645439 3547136  1.7G 83 Linux

Notice the offset because you need it for step 4

4- Mount the image with loop and add the ssh file

Code: Select all

 sudo mkdir /mnt/sdcardP1
 sudo mount -o loop,offset=$(echo "8192*512"| bc) 2018-11-13-raspbian-stretch-lite.img /mnt/sdcardP1
 cd /mnt/sdcardP1
 sudo touch ssh
 

5- umount the image et voila!

Code: Select all

sudo umount /mnt/sdcardP1
sudo rmdir /mnt/sdcardP1

Now use that version to fill your SDCard! On the first boot the ssh will be available.

B.T.W. A RaspberryPi is a linux computer.

[danjperron]

Ok I create a single bash script to add the ssh file on the first partition image

addsshfile.sh

Code: Select all

#!/bin/bash

#create mountpartition
mkdir -p  /mnt/sdcardP1
#get partition offset
echo "$1"
typeset -i sectorOffset=`fdisk -l "$1" | awk '/img1/{print $2}'`
byteOffset=$(($sectorOffset*512))
#mount partition
mount -o loop,offset=$byteOffset $1 /mnt/sdcardP1
if [ $? -eq 0 ]; then
  touch /mnt/sdcardP1/ssh
  if [ $? -eq 0 ]; then
    echo "ssh created"
  else
    echo "unable to create file ssh in first partition"
  fi
  #unmount partition
  umount /mnt/sdcardP1
else
  echo "unable to mount file"
fi

Change the script to be executable
ssh +x addsshfile.sh
and run the file with the name of the image using sudo

Code: Select all

daniel@linuxserver:/usr/data/public/RaspberryPi$ sudo ./addsshfile.sh 2018-11-13-raspbian-stretch-lite.img
2018-11-13-raspbian-stretch-lite.img
ssh created

Then the new image will enable the ssh on the first boot.


P.S. You could use that method for your WPA settings. This way when you have a new OS just run the script once for the new image and the WPA settings will be correct when you write a new flash card.

[HawaiianPi]

It is simple to add a file name "ssh" in the boot partition to enable the ssh on first boot. Then you ssh on it and do raspi-config to enable it for good.

Nope, no need to use raspi-config at all. Once SSH has been enabled with the "ssh" file, it will remain enabled until you manually turn it off.

Yes, but that would require a keyboard and screen for the initial installation, so we're back to square one.

Not true!

You really should read a post before replying to it. Your long-winded reply had nothing to do with my post that you quoted. Go back and read my post again, and this time look at the posts I quoted for context. EDIT: And see my previous reply in which I also explained the ssh file.
viewtopic.php?f=66&t=230361#p1412501

[danjperron]

Sorry about that . I should have make two posts.

I just reply to that specific sentence that in M.O. is wrong!

The proof!

I just download ubuntu 64 bit server and copy the image into the SDcard. Once it was done I put the card into the PI3 and connect to it using ssh.

The first thing it did is to force me to change the password . (user:ubuntu password:ubuntu)
No screen and no keyboard!

viewtopic.php?f=63&t=230742#p1413395


The other part of the post was a way to modify the official image to include the ssh file directly before writing the SDCard.

[Imperf3kt]

Sorry about that . I should have make two posts.

I just reply to that specific sentence that in M.O. is wrong!

The proof!

I just download ubuntu 64 bit server and copy the image into the SDcard. Once it was done I put the card into the PI3 and connect to it using ssh.

The first thing it did is to force me to change the password . (user:ubuntu password:ubuntu)
No screen and no keyboard!

viewtopic.php?f=63&t=230742#p1413395


The other part of the post was a way to modify the official image to include the ssh file directly before writing the SDCard.

That's an account already on the operating system.

What is being said is how do you make the account?

Think about it.
To make a user account, which you need to use SSH, you need one of two things: a screen and keyboard, or SSH.
Since you cannot SSH until the account is created... You have but one option left.

[danjperron]

That's an account already on the operating system.

What is being said is how do you make the account?

Yes Ubuntu has the account set and force the user to change the password because it is time overdue!

This is another method to have the user change the password. Has soon that you login it will ask to change the password.

But it is not fully secure because somebody could change the password before you log into it if your Raspberry Pi is connected to the Net. It will be wise the change the password first and then connect to the internet.

Since you cannot SSH until the account is created... You have but one option left.

ubuntu account is there so it is already created. ssh works on first boot! No need for keyboard and screen!

[Imperf3kt]

That's an account already on the operating system.

What is being said is how do you make the account?

Yes Ubuntu has the account set and force the user to change the password because it is time overdue!

This is another method to have the user change the password. Has soon that you login it will ask to change the password.

But it is not fully secure because somebody could change the password before you log into it if your Raspberry Pi is connected to the Net. It will be wise the change the password first and then connect to the internet.

Since you cannot SSH until the account is created... You have but one option left.

ubuntu account is there so it is already created. ssh works on first boot! No need for keyboard and screen!

Which is almost exactly how Raspbian currently works!

What was being pointed out was that if you wanted to force a user to create a new (first) account, as a better way of security, then they couldn't SSH until that account existed, which means they cannot SSH into the Pi to create it and therefore will require a keyboard and screen minimum, regardless.

[HawaiianPi]

Yes Ubuntu has the account set and force the user to change the password because it is time overdue!
...
But it is not fully secure because somebody could change the password before you log into it if your Raspberry Pi is connected to the Net. It will be wise the change the password first and then connect to the internet.

And how do you do that without a keyboard and screen (in a way that's simple for beginners)?

ubuntu account is there so it is already created. ssh works on first boot! No need for keyboard and screen!

And that is a security risk, the very same security risk that Raspbian addressed by disabling SSH.

The Raspbian developers chose to eliminate this risk, and offered a simple way to turn on SSH at first boot ... which also restores the risk, but at least it's the user's choice (and you are secure if you don't need SSH).

Raspbian Stretch Desktop versions also have a startup script that changes the password before connecting to the network. They just haven't implemented that in Lite yet, probably because most beginners will start with the Desktop OS. It's not a perfect solution, but it's better than exposing beginners to possible hacking without their knowledge (which is what Ubuntu does).

[danjperron]

And how do you do that without a keyboard and screen (in a way that's simple for beginners)?

just burn the image and plug into the PI3B.

Don't forget the first post is about headless. No keyboard and no monitor!

So the easiest way to communicate without screen or keyboard is SSH. This is what this post is about!

If you have a mac or linux computer, just type "ssh ubuntu@IP_OF_YOUR_PI" and use the password ubuntu the first time. It will automatically force you to set a new password . On a windows machine install putty.

And that is a security risk, the very same security risk that Raspbian addressed by disabling SSH.

Yes it is a risk and now it is your turn to not read completely what I posted. The risk could be minimize, like I said, by changing the password before you connect the Pi on the Internet and this using your local network via ssh. The way to block internet from your local network is up to you! From me will be to unplug the ethernet cable from the modem. But in reality if you're at home behind a router . The chances are very slim that somebody will have access to your newly ubuntu system before you log on. And since it will ask for a new password right away , it is quite secure.


Don't concentrate on unbuntu you should concentrate on the script I provide to force the ssh on the image if you don't like the way the official image prevent ssh. This could be great by adding on the script the wpa_supplicant.conf. If you have to configure 25 cards for a class then you could add the wifi setup, and the ssh file directly into the image file without the need to configure them later. Going further you could log to the linux partition, inside the image file, and change the hostname. Could be very handy if you create a lab of multiple Rapsberry PI . Mounting an image using the loop device is very powerfull.

[Imperf3kt]

If you want to setup 25 cards for a class, why not setup one card, and clone it 24 times?

[danjperron]

If you want to setup 25 cards for a class, why not setup one card, and clone it 24 times?

Yes this the best option. You setup one card and you image it. Then you could use a script to change the hostname inside the image file before writing a new card.

P.S. Be sure that the initial SDCard is the smallest in memory capacity.

[HawaiianPi]

Yes this the best option. You setup one card and you image it. Then you could use a script to change the hostname inside the image file before writing a new card.

Or you could reserve a unique IP address for each computer in the local router or gateway and not have to worry about hostnames at all. Each of my Pi computers has an IP reservation, so it always has the same address, regardless of what's on the card. You set it up once and save a whole lot of hassle later. Just burn-n-boot, and if you have trouble remembering IP addresses, label them.

P.S. Be sure that the initial SDCard is the smallest in memory capacity.

The SD card copier utility in Raspbian can handle larger or smaller cards (as long as the used space is less than the card capacity). So you could clone a 32GB to an 8GB card if the source card had less than 8GB used on it. I believe Debian x86 with the Raspberry Pi Desktop has that utility as well, which should allow for faster cloning on a PC with USB 3.0. I haven't tried that yet myself (been meaning to).