4 ms·

"a freebsd user with a password of freebsd is available by default for ssh(1) access." And this is why we need security vulnerability scanners that check for d

by mrb 9y ago

"a freebsd user with a password of freebsd is available by default for ssh(1) access." And this is why we need security vulnerability scanners that check for default credentials :-( Instead of telling people to change the password, they should really enforce the change with a one-time script prompting the user on the first login. Edit: I know, only for arm/armv6, but still doesn't excuse the security sloppiness.

inopinatus 9y ago
I agree, but for clarity and context, let's note this only applies to arm/armv6 images.
rsync 9y ago
That's only for the arm/armv6 images. The entire excerpt reads: "Note regarding arm/armv6 images: For convenience for those without console access to the system, a freebsd user with a password of freebsd is available by default for ssh(1) access. Additionally, the root user password is set to root. It is strongly recommended to change the password for both users after gaining access to the system." I feel that if you are installing FreeBSD on ARM devices your cluefulness is quite high and this shouldn't impact you ...
- mrb 9y ago
  "this shouldn't impact you" "should" is a word InfoSec professionals chuckle at.
AdieuToLogic 9y ago
Instead of telling people to change the password, they should really enforce the change with a one-time script prompting the user on the first login. There shouldn't be a need for a script. If the process for installation were enhanced to include something along the lines of 'pw usermod freebsd -p 0', then that would do the trick. EDIT: removed unneeded ellipses in quote 0 - https://www.freebsd.org/cgi/man.cgi?query=pw&apropos=0&sektion=0&manpath=FreeBSD+11.0-RELEASE+and+Ports&arch=default&format=html https://www.freebsd.org/cgi/man.cgi?query=pw&apropos=0&sekti...
aphextron 9y ago
>And this is why we need security vulnerability scanners that check for default credentials :-( Instead of telling people to change the password, they should really enforce the change with a one-time script prompting the user on the first login. SSHD requires RSA encryption and disallows password based auth by default though, so it's meaningless if the attacker doesn't have your key in the first place.

by mrb 9y ago

inopinatus 9y ago

I agree, but for clarity and context, let's note this only applies to arm/armv6 images.

rsync 9y ago

That's only for the arm/armv6 images. The entire excerpt reads: "Note regarding arm/armv6 images: For convenience for those without console access to the system, a freebsd user with a password of freebsd is available by default for ssh(1) access. Additionally, the root user password is set to root. It is strongly recommended to change the password for both users after gaining access to the system." I feel that if you are installing FreeBSD on ARM devices your cluefulness is quite high and this shouldn't impact you ...

mrb 9y ago
"this shouldn't impact you" "should" is a word InfoSec professionals chuckle at.

AdieuToLogic 9y ago

Instead of telling people to change the password, they should really enforce the change with a one-time script prompting the user on the first login. There shouldn't be a need for a script. If the process for installation were enhanced to include something along the lines of 'pw usermod freebsd -p 0', then that would do the trick. EDIT: removed unneeded ellipses in quote 0 - https://www.freebsd.org/cgi/man.cgi?query=pw&apropos=0&sektion=0&manpath=FreeBSD+11.0-RELEASE+and+Ports&arch=default&format=html https://www.freebsd.org/cgi/man.cgi?query=pw&apropos=0&sekti...

aphextron 9y ago

>And this is why we need security vulnerability scanners that check for default credentials :-( Instead of telling people to change the password, they should really enforce the change with a one-time script prompting the user on the first login. SSHD requires RSA encryption and disallows password based auth by default though, so it's meaningless if the attacker doesn't have your key in the first place.