The Pi Wire

Raspbian's tight security

In the wake of IoT attacks, Raspbian has taken an important step towards increasing security.

The Raspberry Pi Foundation has tightened security around Raspbian PIXEL [7], its official operating system for Raspberry Pi. Users may notice that when they install Raspbian PIXEL through NOOBs, they won't be able to 'ssh' into the system as it is now disabled by default

SSH (Secure SHell) is a networking protocol that's used on Linux/UNIX system to log into the system and manage it remotely.However, hackers can sometimes exploit this loophole outside private networks to take control of the system. Considering the massive botnet attack using IoT devices that took down the Internet, it's a wise decision to disable SSH by default. especially asRaspbian also has a default password, which makes it even easier for an attacker to target the Pi.

Previously, SSH could be enabled and disabled from raspi-config utility or GUI tool 'Raspberry Pi Configuration', but the Raspberry Pi is oftenused headlessly – without a keyboard or mouse. However headless users can still insert the Pi's microSD card into a computer and save a file called 'ssh' into the /boot/ directory. It can't be an empty file. When Raspbian boots and finds 'ssh' in the directory, it enables SSH and deletes the file.

There is also now a warning message if SSH is enabled and the password is still set to the default 'raspberry'. Both are non-intrusive ways to protect users from attacks, without breaking functionality or adding complexity.

Buy this article as PDF

Express-Checkout as PDF

Pages: 4

Price $2.95
(incl. VAT)

Buy Raspberry Pi Geek

Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content