How secure is Pandora's root password?

[dimag0g]

Hello all,

I'm using my Pandora as a server to share family photos and the like. I also have an SSH access to it in case I need to access personal files or do remote maintenance.

Of course, from day one there are lots of "hackers" from around the world who try to login to my SSH server as root. I didn't set root password on the Pandora and I suppose it's set some kind of random string which will be impossible to guess. Am I right?

If there are other pointers concerning web security I'd like to hear them as well.

 

[ekianjo]

Not questioning your choice, but wouldn't that be better to use a Raspberry Pi for this kind of purpose?

 

[dimag0g]

It would, but:

- I can't use both Pandoras at once, so my spare unit is working instead of just accumulating dust.

- I have access to a Pandora from everywhere so I can answer pandora-related questions here on the forum

- I got my second pandora for 95€ plus shipping, so a Pi with equivalent hardware would have cost more

- I don't have to learn Pi-specific stuff

When I will need my Pandora back I will probably buy a Pi to replace it as the server.

 

[pmprog]

My understanding was that root doesn't have a password and that it's not allowed to log in - locally or remotely; and the only way to access a root account is by "sudo su"

I could be very wrong on this though

 

[ekianjo]

- I got my second pandora for 95€ plus shipping, so a Pi with equivalent hardware would have cost more - I don't have to learn Pi-specific stuff

For these two points:

- a raspberry Pi 2 now costs only 35 dollars and is probably more powerful than the current Pandora, hardware wise, with the new 4-cores processor.

- there's nothing much specific to learn wtih the Pi, you can install a standard Debian distro (Raspbian) and treat it like another Linux computer.

 

[dimag0g]

My understanding was that root doesn't have a password and that it's not allowed to log in - locally or remotely; and the only way to access a root account is by "sudo su"


I could be very wrong on this though

There seems to be a hash in /etc/shadow for root user

 

[sebt3]

make sure your user password is strong enough. You could also completly lock your root account so only sudo could work remplace the password hash for root in /etc/shadow with a simple '!'

at this point there no password that could match that '!' so root cant login

 

[dimag0g]

- I got my second pandora for 95€ plus shipping, so a Pi with equivalent hardware would have cost more

- a raspberry Pi 2 now costs only 35 dollars and is probably more powerful than the current Pandora, hardware wise, with the new 4-cores processor.

You mean I'd have a server without nubs?!?

 

[dimag0g]

make sure your user password is strong enough. You could also completly lock your root account so only sudo could work remplace the password hash for root in /etc/shadow with a simple '!'


at this point there no password that could match that '!' so root cant login

So that's what the '!' is for! But why does root have a password in the first place?

 

[sebt3]

But why does root have a password in the first place?

because those who setup the pandora 1st boot wizard never though about doing it this way

 

[Willhelm]

*panicmode on*

is there a secret root account located on the pandora?

--- just kidding

 

[Björn]

In some distributions like Ubuntu, the root account is set up, so that you can only use it through sudo. The first user, that the install wizard creates will have full permissions to use sudo. I don't know if SuperZaxxon is also set up this way, but you can achieve the same effect by installing sudo, giving your user full permission (like "username ALL = (ALL) ALL" inside sudoers) and then doing passwd -l root inside a root shell.
If you have SSH, however you should deactivate root login completely. Theres an option inside sshd_config named "PermitRootLogin" which you should set to no. You should also setup a very strong password or better SSL certificate based authentication, for the user that you login to SSH and disable sudo for this user.

 

[Linux-SWAT]

https://stribika.github.io/2015/01/04/secure-secure-shell.html