It is now very nearly impossible to install a headless Pi

There is a way to set a user up in a "userconf.txt" file described here:

I agree, they're trying too hard to save users from themselves in case someone leaves their RPi open to incoming SSH connections on the internet. But most obviously won't do that.

It would be easy enough to force the user to change the password at first boot, that's what some of the other distributions for SBCs do. Armbian, in particular, gives you root at boot but you have to set a password that isn't the default "1234".

Removing the user altogether seems to be the nuclear option, especially if you got used to setting up headless devices.

Does:

$ sudo apt install rpi-imager

not work for you?

It's been in Ubuntu since 22.04, possibly before that.

There is also

$ sudo snap install rpi-imager

which comes from

Well, if you put that on the internet you're in for trouble.

More to the point it's now illegal to have default usernames and passwords in the UK, so the RPi folks have to comply.

You are free to write the image to SD and then mount it and edit /etc/passwd and /etc/shadow to change the login user/password if you so desire.

Theo

Or set up an ~userid/.ssh/authorized_keys file, with sshd enabled

That’s not “broken”. dpkg is a very low-level tool that only knows how to install the .deb files you specify to it. Either explicitly download and install the extra ones it says it needs, or if you want automatic dependency resolution, you need the higher-level “apt-get” command.

UTRTFTJ.

Yes, I did find that, but it is messy having to create hashed entries etc.

I did try that, or at least I thought I had created a user with no password but it didn't work. I may have been getting a bit frustrated by then though so it's quite likely I got something wrong.

In the end I managed to install rpi-imager, it's in the Ubuntu repositories now so installing it from there brings in all the missing dependencies I saw.

OP here, that's actually quite a neat way to do it. I use ssh a lot (with and without key authorisation) so it wouldn't be too difficult.

Who puts a 'naked' Raspberry Pi on the internet? 99.999% of them will either be stand-alone systems not connected to anything or will be on a home LAN behind NAT and a firewall.

Yes, I did find I could install rpi-imager from the Ubuntu repositories, that's how I managed to get installed in the end.

How about no password, would that be OK? :-)

According to Shodan there are 22,700 systems claiming to be 'Raspbian' on the internet.

Also, even if the Pi is firewalled, there is a threat from other users of the LAN including compromised machines. You only need one machine to be compromised to allow attackers into the network and then they can search out for vulnerable machines from there.

If your network only has you, yourself and I, this is a different threat from say a school where there are potentially many machines out of your control.

OK, so your thread title is inaccurate.

It would be illegal to sell something in that state.

Otherwise, it depends on your threat model...

Theo

Wot? No more FIELD/SERVICE? How will we cope?

I used to use one as a router originally with a USB ethernet and later using VLANs and a managed switch, not since I got FTTH though. It was running FreeBSD though.

Re: It is now very nearly impossible to install a headless Pi By: Chris Green to All on Fri Jan 26 2024 07:52 pm

You have just reminded me of this article about autmated RPi headless deployments, but I don't know if it still applies:

DEC/VMS joke. I think. ;)

On install, you CAN select 'pi' as the username and anything you want as the password. It WILL complain - but will do it if you demand. If you change passwords later there's more of a chance it will demand "minimum complexity" (that's deep in the PAM stuff).

IMHO, the more important bit is the password, not the user name. Make 'em a bit strange and not TOO damned short. A guy in my office used to use "." as his Winders password :-)

Saw little article today ... "qwerty123" has become almost as nefarious as "password"

Now if you're a bank or e-commerce site or something higher profile then yea, gotta get more complicated and add fail2ban and some other stuff for sure. North Korea is not going to spend five days worth of CPU time to crack your little home Pi and its valuable horde of "Rick and Morty" vids. Your home connection is likely too slow to be very useful for launching broadscale attacks on other systems as well.

Indeed. I've two servers on the open internet with open ssh ports . In 8 years although there is a constant stream of login attempts no one has guessed the correct user name - let alone the password.

People get paranoid about stuff they think they know about and forget the simple things. A long but easily memorable string like my.cat.hates.PIZZA! will probably fall to a dictionary attack in a few thousand hours, but really, who cares?

Sorry, you are not that important, and neither am I.

I've never understood how this can work. If you type a wrong password to ssh it will wait several seconds before allowing you to try again. In addition it will throw you off completely after three failures and you'd have to start all over. This is default ssh, no fail2ban or anything like that.

So how can a dictionary attack possibly work? It would take years!

Bombard the machine with SSH connections. There's no delay (aside from the CPU overhead) for starting a new connection, so don't bother with the timeout, just throw as many parallel connections at the machine as you can. If you get rejected, just terminate the TCP connection and open a new one. Or just wait out the timeout, with X thousand parallel connections it doesn't waste any resources doing that.

Next, run it via a botnet so each connection comes from a different IP, so avoiding fail2ban and similar firewall techniques.

Finally, parallelise over a lot of different victims. Maybe you'll get lucky at one victim, it's just a matter of probabilities.

These are often not dictionary attacks in the sense of trying all the dictionary words (including the d1ct10n4ry w0rds etc), but using lists of known usernames/passwords. Which you can be sure pi:raspberry is on.

Theo

Not sure how it works, but I see series of attacks spaced about 5 seconds apart. Usually from different IP addresses

Well exactly. It's been going on for years!

But grumpyOldSod:suckMyDick.57 probably is not...