4 ms·
How would you log in for the first time into a headless device?
by marginalia_nu 3y ago
How would you log in for the first time into a headless device?
- Filligree 3y agoI'd use a base image with a baked-in SSH certificate allowed. Fairly trivial to make, at least with NixOS.
- marginalia_nu 3y agoThis hinges on this being either a VM or some hardware you've set up yourself.
- booi 3y agowhat other situation would you be in?
- fragmede 3y agoAny device where you don't control the initial firmware, and the firmware doesn't support ssh keys. AP/Routers (consumer and commercial and industrial grade), Shared hosting with ssh but limited features (eg GoDaddy)...
- nine_k 3y agoFor physical devices, you can usually connect them via a dedicated Ethernet cable right to your laptop, and set the initial password. They likely don't have the right network settings anyway to drop them right into the bigger LAN. Otherwise I think you just prepare a certificate ahead of time, and scp it during the first connection, then immediately disable password-based access, or at least change the password. Any passive eavesdropping still needs to defeat the encryption somehow (no feasible ways are known now), even having seen the initial exchange. If you have an active MITM attack, all bets are off, because the attacker could even grab the image with the pre-baked key you're sending, and copy or change the key. If this is not possible, then the pre-baked key would help. If your security is really important, don't use ther cheap GoDaddy's offerings with limited SSH.
- marginalia_nu 3y agoLet's say you bought a router and now you want to log into it.
- samus 3y agoThen you connect physically and do whatever is necessary to prepare that router for your intended use.
- marginalia_nu 3y agoConnect to what? It only has an ethetnet jack.
- dan_quixote 3y agoYou can commonly deploy the device/server with the client's public key.
- numpad0 3y agoThat's assuming the device runs GNU/Linux with / mounted rw. But not everything is a laptop or a desktop.
- yjftsjthsd-h 3y agoNo, it's assuming a device running a ssh daemon with something mounted rw or user-modifiable[0] that can hold an authorized_keys file. A NetBSD embedded board that configures sshd with `AuthorizedKeysFile /sdcard/config/authorized_keys` would be fine, for instance. [0] For example, you could let the user write their key to an SD card and then mount it ro on the device.
- fragmede 3y agoSo what do you do when the device has no long-term storage like an SD card?
- samus 3y agoSuch a device is then simply not suitable for situations where the issues with SSH password authentication become relevant.
- yjftsjthsd-h 3y agoWhat kind of device runs sshd but has no persistent storage?
- dredmorbius 3y ago"One time, on first use, where absolutely necessary, and changing password immediately afterwards" seems a reasonable interpretation of "approximately never".
- ChoHag 3y ago[dead]
- vladvasiliu 3y agoSame way you'd get the password? It's either a physical or virtual server you more or less control, in which case the siblings' answers apply. Otherwise, it's probably some kind of image or something someone else controls, in which case bake in or send them your public key or certificate (if you've got colleagues in the same situation as yourself).
- marginalia_nu 3y agoGetting a password does not require modifying the system. Injecting a public key does.
- rollcat 3y agoThe remote system must generate its own SSH private key; you could use that opportunity to deploy the authorized keys before sealing the system as read-only.
- vladvasiliu 3y agoThe password needs to be generated somehow, right? Assuming you don't you use a pre-baked password that repeats across machines, you could replace the password generation and retrieval with deploying a public key instead.