It is now very nearly impossible to install a headless Pi

It’s a standard part of any attack toolkit. No real knowledge required.

If you’re not worried about the outbound connections then use keys and save yourself the hassle of typing in passwords.

That's handy - for miscreants. I assume from that machine you can log in to other machines on your network? If so they will be able too.

It's one key for each device account which you want to be able to log on to your network. That way if a device gets lost you can remove it's key to prevent access, but all the other keys remain valid and can still be used.

---druck

Every time someone sent me a note about smelly e-mail I'd look through the html/js for telltale signs and often investigate links (some were to legit entities like PayPal but with a defective reference number - and then you were supposed to use an alt address or even call (one call for a supposedly local US company was actually a Turkish phone#).

Found a few with links to what WAS a legit company wanting us to check into an invoice - but the company was a mining- equipment rental company, in Australia.

Another good question is to ask "Does anyone remember EVER doing business with these people ?". Often it was "No".

Sometimes the evil is hidden as attached Word dox or Excel spreadsheets or links to same - with lots of interesting macros. Best research is done with LibreOffice - and DON'T enable any macros. Incompatibility has its uses.

Anyway, they can be VERY sneaky and the rank and file often just click by reflex. A "security validation" page wanting to know a bunch of usernames/passwords/ss# and such, well, that seems legit/safe, doesn't it ? :-)

My practice was to write a couple paragraph exposition of exactly WHY a mail was evil and send it to all those who routinely "did business" in the office. Kept the tech level low, but just enough. These kinda paid off in 'sensitizing' them to what's smelly. Is the mail from some odd entity ? Is it very unclear about WHAT we're supposed to have purchased/paid ? Odd spelling or grammar errors ? No such employee ? Long links to Who-Knows-What ? They DID get better at it.

Thing is, M$ or any other entity you're paying CANNOT spot all these 'human factors' tricks. They might spot 'common' ones with kinda fixed source addresses, but that's about it. Not really a shield, more a sieve.

Oh, found this today :

It's a problem.

It's getting worse, fast.

And there's just no decent replacement for e-mail for biz purposes. We demand receipts, tracking info, mails in case of problems, mails for bills. Doesn't matter if the mail agent is on yer PC or something online, the evil can still getcha. Back to snail-mail ? Ain't gonna happen now.

Linux/Unix can be configured to be fairly resistant to "traditional hacking" - but every user is a serious vulnerability, by multiple approaches.

Hmmm ... sounds like those abovementioned "top secret documents" weren't even encrypted - the group KNEW what it had to bargain with. Oh, it WILL pass the stuff along to Vlad whether you pay 'em or not - patriotic duty !

Ok ... I'm not gonna ask why you'd want a completely separate print server, based on an old Pi, rather than just printing directly from/to whatever :-)

In any case, the "headless" problem is more of a problem with RP-OS based on Worm. They completely changed how the networking was done, and while there IS a CL command with lots of obscure params it's just not as straight-up as it used to be. I posted info on where to look and templates for customizable network defs in order to speed people along in this aspect. Alas that's not the only thing Worm has pointlessly messed-up. Oh, and BullsEye won't run on a Pi-5 - you get a testy little message on boot.

Normally I rec RP-OS because it's probably best-tuned to the boards, easiest tweaking for all the little devices and pins and such. But NOW ... maybe some ARE better off with 3rd-party systems depending. Arch, G2, even Fedora derivs, may be more friendly for "headless". Can't really rec RHEL derivs anymore since IBM ruined it all, don't want to build critical stuff on beta (or worse) code.

Not true, you're advocating separate keys for each remote and not keeping thenm in an agent so login isn't 'passwordless' or automatic.

Thus, when I login I see:-

chris@esprimo$ ssh backup Enter passphrase for key '/home/chris/.ssh/backup_id_rsa': chris@backup$

... the keylogger will see 'ssh backup' followed by the passphrase.

Yes, I'd forgotten that I must admit, I may start doing it in fact as using rpi-imager is becoming more necessary anyway.

I use Mercurial.

I may take a look, though I already have a common Mercurial repository where I keep everything like .bashrc, .profile, .ssh/config and so on. The Mercurial repository is shared across systems using syncthing.

Not neccessarily, I could use a passphrase or different username. Which might not be obvious to an attacker.

However I think if the are on the machine in the first palce I'm in deep s*it.

One compromised host is worth relatively little, but nobody compromises just one host.

- Even a small amount of CPU is worth putting a cryptocurrency miner on, for someone who has automated the process of stealing access.

- Fleets of hacked computers are used in DDoS attacks.

- Individual hacked computer make good jumping off points to obscure the true origin of attacks of any kind.

OK, that's not so surprising.

It avoids massively long printer cables obviously, when you have a pre-existent network of some sort...

r worse) code.

The printers in question (an HP LaserJet 1320 and a Zebra LP2844) don't have built-in network connectivity. The print server is basically a JetDirect-compatible box that receives print data on one port for one printer and on another port for the other. I have an actual, rather old HP JetDirect print server in a box somewhere. It's in a box because its

Yeah I had one of those for a big A1 plotter. Pi is a great idea for a print server.

I wasn't advocating that. The agent's purpose is so you only have to type the passphrase once per session - if that makes keys easier to use and maybe helps you have a stronger passphrase (since you don't need to type it so often), then why not?

There may be some threat models where you don't want your machine holding unlocked keys in RAM, in which case fair enough and you need to type the passphrase each time, but for many use cases ssh-agent (and its integration into things like KDE KWallet or MacOS keychain) is fine.

If the keylogger is running locally, stealing the passphrase from a key won't help the attacker because they don't have the private key.

If the keylogger in an infected SSH daemon on the server (which is where SSH passwords are typically harvested) it will see parts of the public key exchange but it doesn't see your passphrase or private key and the protocol is designed so you can't replay what it does see. If it has passwords it can replay them on other sites.

etckeeper supports that too.

I suppose you could push/pull your etckeeper repo to keep your /etc in sync, but probably not ideal since things like hostnames will be different between machines. Ansible is a better bet.

Theo

Um ... printers have come with network ports/wi-fi for at least 15 or more years now. You don't need "long cables", except for ethernet, and thus the printer can be 300+ meters away in the junk shed and work just fine. You can see and print to it from any PC-like-thing directly.

Now if you have one of those old OKI pin printers (they still have their place and they still sell them) with RS-232 then you may need a cheap adapter (or two) but you can still plug 'em into the ethernet or at least a modern box and share 'em out.

So ... well, I promised not to ask :-)

The increasing difficulty with "headless" is more of an issue these days IMHO. I rarely did totally headless, but on a few lower-powered (Pi) units that was the better way to go to save resources. Even 'simple' GUIs are cpu/memory-hogs at the least.

For easy headless in the near future ... might want to look at the BSDs ...... some pain, some gain ......

Some have, but many people use printers older than that. Or more recent ones that come without network ports or wifi

Um ... check Amazon for adapters. You MIGHT need two. However you OUGHT to be able to get it on ethernet or wi-fi or at least USB on some box where you can share it out. Fifty bucks ?

Now for 1970s/80s printers ... wide Centronics parallel ... ok, you ARE gonna have problems, serious problems ....

RS-232 printers though, far fewer problems beyond drivers. Kept an ancient OKI Microline going for 25 years ... THE thing for multi-page sales forms. They still sell 'em.

Anyway, I promised not to ask ... :-)

Had an old HP pen plotter and HiPad plotting tablet - RS-232. A Pi could work them directly, no 'server' required. You MIGHT want a couple of adapters so you can use USB ports, but the built-in serial works just fine. DRIVERS for old serial printers, they MIGHT still be found ... but the command sets were pretty simple anyway .......

Also, you don't need to use a Pi intermediary, even crappy Winders PCs can be convinced to use/share such devices. Linux/Unix can be even better because they still understand TTY devices better.

This is where we came in! :-)

If you use agent then, once the passphrase has been entered, anyone can walk up and log in to that remote system without know the passphrase.

SOME printers have ....

If a guy wants to run a Pi as a print server, who are you to say it's wrong? They're very good for USB only printers.

No,these days they are looking to recruit POS Chinese IOT stuff running, such as security cameras, "smart" kitchen app licences and god knows what else.

What these things have in common is running a version of Linux with very poor security, such as hardcoded passwords, insecure protocols, no firewalls or intrusion detection, and no one logged in running tools to see why they are slow or are sending data all over the internet (even more than the telemetry than they are meant to send back to the mothership).

Don't make your Raspberry as easy to crack as these things!

---druck