If you know the ip range assigned to a host it would be easy to write a script that listened for new IPs coming up and to perform a dictionary attack on those I

If you know the ip range assigned to a host it would be easy to write a script that listened for new IPs coming up and to perform a dictionary attack on those IPs. Security around provisioning new servers is often ugly with plain text passwords sent in the clear and iptables disabled. Shared keys and disabling plain text passwords in OpenSSH is an obvious solution but for non-technical customers this can be a huge support overhead. Does anyone solve this pattern elegantly? I do see some responsibility on a customer securing a box as soon as it is provisioned though, unless it is a managed service.