Hi there,
What are the pros and cons of having the LiveCD start sshd automatically and to make it not scramble the root password?
This would make it so much easier installing Gentoo on my new server, as I wouldn't have to connect monitor and keyboard to set things up...
Surely, there is a security risk... But how much sensitive data is really stored on a server about to install a new operating system?
It could be noted somewhere that if you want real security, you should change the root password immediately after logging in...
(the default password could be "gentoo" or something)
Thoughts?
- Simon
Install CD wish: sshd started, no root password scrambling
Message
- PowerFactor
- Veteran
- Posts: 1693
- Joined: Thu Jan 30, 2003 7:45 pm
- Location: out of it
To be honest the idea scares me a little. For most of us it wouldn't be a much of a security risk at all. I myself woul never leave a newly installed machine open to the internet and noone else usually had physical access to my lan.
But I'm thinking of the total linux newbie who lives in a dorm with a direct connection to the internet. He/she doens't have a hardware firewall, has no idea about rootkits. Somehow he misses/ignores the step about seting the root password in the begining so he has an open ssh server with no password on the root account for the whole time he is doing a stage1 install. So someone finds his box he has a rooted box from the very begining wreaking havok on the network till the admins cut him off. Not very likeley I know but still. It wouldn't take many to give gentoo a bad name with the admins at that university.
How about this instead. I don't know how to implement this but it might not be too hard. Still scramble the root password by default but have an optional configuration floppy which would allow you to specify a root password among possibly other things. Yeah I know just leaving the root password blank would be easier. It's just a thought.
But I'm thinking of the total linux newbie who lives in a dorm with a direct connection to the internet. He/she doens't have a hardware firewall, has no idea about rootkits. Somehow he misses/ignores the step about seting the root password in the begining so he has an open ssh server with no password on the root account for the whole time he is doing a stage1 install. So someone finds his box he has a rooted box from the very begining wreaking havok on the network till the admins cut him off. Not very likeley I know but still. It wouldn't take many to give gentoo a bad name with the admins at that university.
How about this instead. I don't know how to implement this but it might not be too hard. Still scramble the root password by default but have an optional configuration floppy which would allow you to specify a root password among possibly other things. Yeah I know just leaving the root password blank would be easier. It's just a thought.
This could be easily fixed by forcing the user at the first logon to change password. As for the floppy, good idea, but all of my machines (servers and desktops) are floppy-less, so it wouldn't work very well in my case. And using a CD-R with custom settings or so wouldn't be very convinient (I know, spelled it wrongBut I'm thinking of the total linux newbie who lives in a dorm with a direct connection to the internet. He/she doens't have a hardware firewall, has no idea about rootkits. Somehow he misses/ignores the step about seting the root password in the begining so he has an open ssh server with no password on the root account for the whole time he is doing a stage1 install.
).[/quote]MrWolf's suggestion seems like a really good idea! 
It could easily be fixed with a little bash scripting...
Also, the root password should never be blank... My suggestion was that it could be "gentoo" or "larrythecow" or something, which would make a difference (though not secure enough, still harder to break than blank...)
- Simon
It could easily be fixed with a little bash scripting...Also, the root password should never be blank... My suggestion was that it could be "gentoo" or "larrythecow" or something, which would make a difference (though not secure enough, still harder to break than blank...)
- Simon
Re: Install CD wish: sshd started, no root password scrambli
Can't you hack the iso yourself? I don't have a clue about how the boot cd works but I'm sure it is documented somewhere. Mount the iso, set the rootpasswd to something only you know, setup the network and start sshd. Now burn it and boot from the cd and use your nice ssh connection.Cossins wrote:Hi there,
What are the pros and cons of having the LiveCD start sshd automatically and to make it not scramble the root password?
This would make it so much easier installing Gentoo on my new server, as I wouldn't have to connect monitor and keyboard to set things up...
Surely, there is a security risk... But how much sensitive data is really stored on a server about to install a new operating system?
It could be noted somewhere that if you want real security, you should change the root password immediately after logging in...
(the default password could be "gentoo" or something)
Thoughts?
- Simon
Powered by Gentoo since 1.0_rc6
Re: Install CD wish: sshd started, no root password scrambli
Last I checked the ssh daemon wasn't started automatically. How would you start it with no keyboard?Cossins wrote: This would make it so much easier installing Gentoo on my new server, as I wouldn't have to connect monitor and keyboard to set things up...
If you really need this I thnk it wouldn't be a big job to hack the livecd, get it to start sshd on boot and have a password set to your preference. Of course, it relies on the livecd picking up your network card and setting up networking perfectly.
The benefit of doing this yourself is that the security issue is nullified by the fact that you set the password yourself. You could also enable login on the livecd for the first tty as well, then if someone waltzed along and found your machine which your installing over ssh they couldn't just start erasing things, although they could just pull the power cable.
Puggy
The benefit of doing this yourself is that the security issue is nullified by the fact that you set the password yourself. You could also enable login on the livecd for the first tty as well, then if someone waltzed along and found your machine which your installing over ssh they couldn't just start erasing things, although they could just pull the power cable.
Puggy
Where there's open source , there's a way.
I voted no. but the real awnser from me would be yesno
Basicaly, having SSHD installed, but not started, on the live cd, would be interesting.
I know for me it's the very first thing I install. That way I can work remotly. However, having a standard root password is a BAD idea. A lot of people will just keep it. That makes for very weak security. It's not as if it is hard to change it yourself. It's even explained in the procedure how.
What I would like to see is a compromise. Have SSH installed, but we'd have to manualy start it. Say, with a simple command like startssh or something the like.
that way, we need minimum intervention on the machine itself then we can work remotly.
Basicaly, having SSHD installed, but not started, on the live cd, would be interesting.
I know for me it's the very first thing I install. That way I can work remotly. However, having a standard root password is a BAD idea. A lot of people will just keep it. That makes for very weak security. It's not as if it is hard to change it yourself. It's even explained in the procedure how.
What I would like to see is a compromise. Have SSH installed, but we'd have to manualy start it. Say, with a simple command like startssh or something the like.
that way, we need minimum intervention on the machine itself then we can work remotly.
Someone asked me once if I suffered from mental illness. I told him I enjoyed every second of it.
Out of the passwd man:
Couldn't this be used to set the password of root to gentoo or something and require him to change it at first login (through ssh or whatever)?If you wish to immediately expire an account's password, you can use the -e option. This in effect can force a user to change his/her password at the user's next login.
The livecd has an ssh server. It's the first thing it tells you about once you login and the simple command ismadchaz wrote:I voted no. but the real awnser from me would be yesno
Basicaly, having SSHD installed, but not started, on the live cd, would be interesting.
I know for me it's the very first thing I install. That way I can work remotly. However, having a standard root password is a BAD idea. A lot of people will just keep it. That makes for very weak security. It's not as if it is hard to change it yourself. It's even explained in the procedure how.
What I would like to see is a compromise. Have SSH installed, but we'd have to manualy start it. Say, with a simple command like startssh or something the like.
that way, we need minimum intervention on the machine itself then we can work remotly.
Code: Select all
/etc/init.d/sshd startCode: Select all
passwdI believe the point of contention here is whether you should be able to put a livecd into a machine with no input or output devices and get it to launch sshd automatically so you can login without any local interaction at all.
Puggy
Where there's open source , there's a way.
What if someone else logged in first? It would only take a few seconds (if that) for an experienced hacker to set something in motion that would echo your password you set when you get around to loging in or whatever.HermesConrad wrote:Out of the passwd man:Couldn't this be used to set the password of root to gentoo or something and require him to change it at first login (through ssh or whatever)?If you wish to immediately expire an account's password, you can use the -e option. This in effect can force a user to change his/her password at the user's next login.
Puggy
Where there's open source , there's a way.
Uhm, then I think you have bigger problemspuggy wrote:What if someone else logged in first? It would only take a few seconds (if that) for an experienced hacker to set something in motion that would echo your password you set when you get around to loging in or whatever
Btw, would it be possible to pickup on the fact that no keyboard is attached? I seem to remember that the kernel cries a little when no keyboard is present during boot. Now, if we could utilize this information, the livecd would then choose a preset password (gentoo or whatever, maybe specific for each release?) and then FORCE the first login (via SSHd which was started automatically aswell since no keyboard was present) to change the password, and it should NOT allow empty passwords or the same, etc.
Ofcourse, this would probably involve alot more than a simple change to the init scripts, but you get the best of both worlds me thinks.
As an added bonus, the computer should begin beeping if no network settings were picked up, to let you know that sshd is futile at this point.
/MrWorf - Just full of ideas today
Then it might as well always be set static and you just use it to login locally instead.MrWorf wrote:Btw, would it be possible to pickup on the fact that no keyboard is attached? I seem to remember that the kernel cries a little when no keyboard is present during boot. Now, if we could utilize this information, the livecd would then choose a preset password (gentoo or whatever, maybe specific for each release?)....
This makes no difference. If someone else managed to log in before you did then you'd still have your security compromised. The beeping would also be useless probably as most remote installs I suspect will be, errr, remote....and then FORCE the first login (via SSHd which was started automatically aswell since no keyboard was present) to change the password, and it should NOT allow empty passwords or the same, etc. Ofcourse, this would probably involve alot more than a simple change to the init scripts, but you get the best of both worlds me thinks.
As an added bonus, the computer should begin beeping if no network settings were picked up, to let you know that sshd is futile at this point.
/MrWorf - Just full of ideas today
Puggy
Where there's open source , there's a way.
I've been thinking about doing this hack myself. Clearly we still need the current "secure" LiveCD. But a LiveCD that starts up sshd with a known root password would be mighty handy to have around.
I've got a 200 MHz P III that I run sans keyboard and screen. It is on a local net so I am not worried about badies cracking in. But now, if I want to boot off of the LiveCD (which is very handy on occasion) I've got to haul out a keyboard, monitor and mouse, clear off a space on my desk, etc.
I've got a 200 MHz P III that I run sans keyboard and screen. It is on a local net so I am not worried about badies cracking in. But now, if I want to boot off of the LiveCD (which is very handy on occasion) I've got to haul out a keyboard, monitor and mouse, clear off a space on my desk, etc.
After Perl everything else is just assembly language.
Uhm, wouldn't that defeat the whole idea of remote logon/install? The difference with a remote install contra local is that when it is remote, the computer probably doesn't have a keyboard or screen. So a static password is less dangerous (but still not good security) than on a local install where someone could potentially do some harm.Puggy wrote:Then it might as well always be set static and you just use it to login locally instead.
Ofcourse, when the password is preset, there should be NO local login, since there is no keyboard.
The reason for the beeps was to provide a solution to "what if it doesn't pickup the network when booting?" question. And often, since you physically have to insert the CD somehow, you'd probably be able to hear the beeps. Or you would when you walked back to see why you couldn't logon remotely.Puggy wrote:This makes no difference. If someone else managed to log in before you did then you'd still have your security compromised. The beeping would also be useless probably as most remote installs I suspect will be, errr, remote.
One way to add more security is to somehow make the LiveCD a multisession one, first, you burn the ISO, then you add a second session where the required SSH key is. This way, you could have a remote install. You don't need a floppy nor any kind of loose security. When the LiveCD boots, if it finds the second session (or whatever), it should go into remote mode.
But all in all, I doubt it will be worth the trouble
I know the feeling, did that just some weeks agoJimbow wrote:I've got a 200 MHz P III that I run sans keyboard and screen. It is on a local net so I am not worried about badies cracking in. But now, if I want to boot off of the LiveCD (which is very handy on occasion) I've got to haul out a keyboard, monitor and mouse, clear off a space on my desk, etc.
If the password is preset there might as well be no password as it'll make no difference to the hacker. Hence there is no point in only using a static login for the remote install as long as the local interface is logged out on boot.MrWorf wrote:Uhm, wouldn't that defeat the whole idea of remote logon/install? The difference with a remote install contra local is that when it is remote, the computer probably doesn't have a keyboard or screen. So a static password is less dangerous (but still not good security) than on a local install where someone could potentially do some harm.Puggy wrote:Then it might as well always be set static and you just use it to login locally instead.
There isn't necessarily no keyboard.Ofcourse, when the password is preset, there should be NO local login, since there is no keyboard.
Fair enough.The reason for the beeps was to provide a solution to "what if it doesn't pickup the network when booting?" question. And often, since you physically have to insert the CD somehow, you'd probably be able to hear the beeps. Or you would when you walked back to see why you couldn't logon remotely.Puggy wrote:This makes no difference. If someone else managed to log in before you did then you'd still have your security compromised. The beeping would also be useless probably as most remote installs I suspect will be, errr, remote.
That's not a bad idea, but you might as well just stick your key on the livecds main session, and while your there you might as well set the password,and enable sshd to boot on startup by default.One way to add more security is to somehow make the LiveCD a multisession one, first, you burn the ISO, then you add a second session where the required SSH key is. This way, you could have a remote install. You don't need a floppy nor any kind of loose security. When the LiveCD boots, if it finds the second session (or whatever), it should go into remote mode.
It's actually rather easyBut all in all, I doubt it will be worth the trouble
See above link.I know the feeling, did that just some weeks agoJimbow wrote:I've got a 200 MHz P III that I run sans keyboard and screen. It is on a local net so I am not worried about badies cracking in. But now, if I want to boot off of the LiveCD (which is very handy on occasion) I've got to haul out a keyboard, monitor and mouse, clear off a space on my desk, etc.
Where there's open source , there's a way.
I'm not sure if we mean the same thing. I meant that when in remote mode, there should be no local console at all.puggy wrote: If the password is preset there might as well be no password as it'll make no difference to the hacker. Hence there is no point in only using a static login for the remote install as long as the local interface is logged out on boot.
MrWorf wrote:One way to add more security is to somehow make the LiveCD a multisession one, first, you burn the ISO, then you add a second session where the required SSH key is. This way, you could have a remote install. You don't need a floppy nor any kind of loose security. When the LiveCD boots, if it finds the second session (or whatever), it should go into remote mode.
Okay, that would work too, if you have the means to do it. This will not work from ... ahem ... windowspuggy wrote:That's not a bad idea, but you might as well just stick your key on the livecds main session, and while your there you might as well set the password,and enable sshd to boot on startup by default.
Also, the multisession part has the advantage that when a new version of the livecd is released, you just tack on the extra session (that you did a couple of versions ago) and presto, new livecd with remote install
would like to see this.
Makes it a lot easier to install a new server remtely, with the option to be able to reboot the server during the install if necessary.
Security? Well we can access the network from outside by citrix and from citrix with putty into the server we are installing.
Right now I'm installing a server a home, doing the partitions and setting up EVMS, but it seems I need to reboor for the kernel to read the new disc table. But i'm stuck because after rebooting the live cd there is no more ssh . Sniff...
Makes it a lot easier to install a new server remtely, with the option to be able to reboot the server during the install if necessary.
Security? Well we can access the network from outside by citrix and from citrix with putty into the server we are installing.
Right now I'm installing a server a home, doing the partitions and setting up EVMS, but it seems I need to reboor for the kernel to read the new disc table. But i'm stuck because after rebooting the live cd there is no more ssh . Sniff...
No root scrambling would be great! There is no security in the install cdrom anyway. Scrambling the root password just makes you have to type "passwd root" before you can use other terminals.
sshd started by default would be great for headless installs. The way to find the box is check the dhcp server for an unknown host name and ssh to it. I have done two installs remotely now on boxes I intended to be headless. It would have been nice not to have to hook up the mon/key/mouse just to change the root password and start sshd.
BTW... I had created a boot cd using the provided tools that did this, but the cdrom cracked and I no longer have the image. BUT, doing this by default makes sense. 90% of install is not security conscious anyway...
sshd started by default would be great for headless installs. The way to find the box is check the dhcp server for an unknown host name and ssh to it. I have done two installs remotely now on boxes I intended to be headless. It would have been nice not to have to hook up the mon/key/mouse just to change the root password and start sshd.
BTW... I had created a boot cd using the provided tools that did this, but the cdrom cracked and I no longer have the image. BUT, doing this by default makes sense. 90% of install is not security conscious anyway...
-----------------------------------------
Michael
Michael