Headless Pi 4B problems - continued

I think it did.

But I now have a screen and keyboard and a micro HDMI and USB keyboard for when it doesn't.

Its easy enough to run raspi-config after first boot

Really? What is on the end of the iI2C lines then?

Then you are not using it on the Pi are you? But on a different machine...that is configured to use its keycodes already...

Various things, for example several I2C temperature and humidity sensors, some I2C A2D converters, etc.

And you think that none of these are, or contain, 'microcontrollers'?

Well almost everything does nowadays! However they do **present** as a single chip with an I2C interface and nothing else. You don't have to program them as you would an Arduino or an ESPE32. Thus all my configuration and software is in the Pi and all it does is 'talk I2C' down the wires.

WiFi is/was configured in wpa_supplicant.txt, and that worked fine without the RPi imager program.

Was...

All change with bookworm IIRC

UK law: Product Security and Telecommunications Security Act 2022 which is amongst things, designed to stop devices, like routers for example, from having default passwords that can easily be guessed. That's because many people leave the passwords at the default settings and then such devices are more easily roped into DDOS attacks.

Also the California Senate Bill 327:

"(b) Subject to all of the requirements of subdivision (a), if a connected device is equipped with a means for authentication outside a local area network, it shall be deemed a reasonable security feature under subdivision (a) if either of the following requirements are met:

(1) The preprogrammed password is unique to each device manufactured.

(2) The device contains a security feature that requires a user to generate a new means of authentication before access is granted to the device for the first time. "

What about 1.9? (Just curious.)

Probably not. People installing special-purpose distributions (media player, dns filtering, hoem automazion etc.) may not even be aware that they need to change the SSH password when they only interact with some web frontend.

Also, it is not just the data on the device that is at risk. There is also the risk that such an exposed machine will be used as part of a botnet to attack other machines.

A quick check on shodan shows 86362 hits for "ssh raspbian". If only a small percentage of these use the default password, that is way too much.

cu Michael

But ssh is not enabled by default in Raspbian.

Good point (I was not sure - I always enable it, since my pis run headless).

However, I *do* remember news about lots of pis with default passwords being exploited via ssh - but I can't find the sources for that.

Either way, making it difficult for the admin to mess things up is not a bad idea.

cu Michael

Sounds like I got off the RPiOS ship just at the right time before they went completely nuts. Choice of distros is such a wonderful advantage of Linux (even if there's less choice for the Pis than for PC).

They both seem to be about the original topic of log-in passwords, not WiFi settings.

Well I stick to PIOS simple because it is the documented standard. Networking is handled by the Network Manager and it gets tricky to set that up without a console screen/keyboard at least - but there is a great utility called nmcli I think that 'does everything' once you have learnt its magic spells.

And it knows which underlying files to frig with. And gets the syntax right.

To be honest although it is possible to do everything over ssh, the chances of losing connectivity while messing with the network are high and a HDMI screen and a USB keyboard are not hard to rig up with the appropiate adapters.

If you don't like networkmanager, it is easy to switch to the old method after installation of the base system:

got me to a state where the classic configuration using /etc/network/interfaces just works.

I had a serial console connected, but that is only activated at a later step. I sued raspberry pi imager to setup ssh pre-boot, but you can easily do that using a text editor.

cu Michael

There's also nmtui, which works in the same places nmcli does, but is much easier to navigate.