How secure is Pandora's root password?


dimag0g

Very Active Member
Joined
Jan 12, 2011
Messages
608
Location
Strasbourg, France
Hello all,

I'm using my Pandora as a server to share family photos and the like. I also have an SSH access to it in case I need to access personal files or do remote maintenance.

Of course, from day one there are lots of "hackers" from around the world who try to login to my SSH server as root. I didn't set root password on the Pandora and I suppose it's set some kind of random string which will be impossible to guess. Am I right?

If there are other pointers concerning web security I'd like to hear them as well.
 
It would, but:

- I can't use both Pandoras at once, so my spare unit is working instead of just accumulating dust.

- I have access to a Pandora from everywhere so I can answer pandora-related questions here on the forum

- I got my second pandora for 95€ plus shipping, so a Pi with equivalent hardware would have cost more

- I don't have to learn Pi-specific stuff

When I will need my Pandora back I will probably buy a Pi to replace it as the server.
 
My understanding was that root doesn't have a password and that it's not allowed to log in - locally or remotely; and the only way to access a root account is by "sudo su"

I could be very wrong on this though
 
- I got my second pandora for 95€ plus shipping, so a Pi with equivalent hardware would have cost more - I don't have to learn Pi-specific stuff
For these two points:

- a raspberry Pi 2 now costs only 35 dollars and is probably more powerful than the current Pandora, hardware wise, with the new 4-cores processor.

- there's nothing much specific to learn wtih the Pi, you can install a standard Debian distro (Raspbian) and treat it like another Linux computer.
 
My understanding was that root doesn't have a password and that it's not allowed to log in - locally or remotely; and the only way to access a root account is by "sudo su"


I could be very wrong on this though
There seems to be a hash in /etc/shadow for root user
 
make sure your user password is strong enough. You could also completly lock your root account so only sudo could work remplace the password hash for root in /etc/shadow with a simple '!'

at this point there no password that could match that '!' so root cant login
 
make sure your user password is strong enough. You could also completly lock your root account so only sudo could work remplace the password hash for root in /etc/shadow with a simple '!'


at this point there no password that could match that '!' so root cant login
So that's what the '!' is for! But why does root have a password in the first place?
 
In some distributions like Ubuntu, the root account is set up, so that you can only use it through sudo. The first user, that the install wizard creates will have full permissions to use sudo. I don't know if SuperZaxxon is also set up this way, but you can achieve the same effect by installing sudo, giving your user full permission (like "username ALL = (ALL) ALL" inside sudoers) and then doing passwd -l root inside a root shell.
If you have SSH, however you should deactivate root login completely. Theres an option inside sshd_config named "PermitRootLogin" which you should set to no. You should also setup a very strong password or better SSL certificate based authentication, for the user that you login to SSH and disable sudo for this user.
 
Back
Top