You are right, randomly guessing the password (brute forcing it) or using any kind of dictionary attack (where you try most commonly used passwords, like the default password for RB PI), is no more secure for any users than for root. Also I am not fancy with the concept of typing the user's own password when sudo-ing (if you guessed the password already to log on, then you have no additional security measurement to get root access on the system). However, the trick is that you also need to guess the username, whereas with the root you know that already. Sometimes it is easy to find these things out, sometimes it is not. The other improvement using a normal user instead of the root is that it is easier to lock down the ordinary user than the root if a break-in attempt discovered (there are many ways to automatically disable a user for a certain amount of time when more than X unsuccessful password was tried within Y period of time). If you were locking down the root, then you could do nothing to log on locally and unlock the blocked user, so someone could very easily lock you out of your system if that happens. That is the reason why brute-force technique works well on root, as you are very unlikely to disable the root account even if that attempt has been discovered... Tamas On 29 September 2012 09:09, V G wrote: > On Fri, Sep 28, 2012 at 5:22 PM, William "Chops" Westfield > wrote: > > > [...] Pown'd [...] > > > > My goodness, Mr. Westfield! You are a grown man! > > ---- > > If you guys think security in this case is paramount, you're forgetting > that it's no more secure having a normal account and exposing it via SSH. > As long as there's a default set of passwords and ssh is enabled at all, > the device is equally as vulnerable. Disabling root SSH login but enabled > for normal users is just an illusion of security. > > Given the context here, > - A significant number of people (if not the majority) still use > monitors/keyboards/technology that is not modern (that is, not HDMI, USB, > etc.), but pretty much everyone uses 10/100/1000 type Ethernet. For > example, a large number of schools in India still use VGA monitors and PS= /2 > keyboards and mice, but use Ethernet that can plug into the board. > - It is an embedded development board, not a public server. > - Initial usage is on a local (trusted) network. Those who want to expose > it to a public network are already aware of their purpose and that they > should ensure security. > > It is probably not an unreasonable thing to do to enable initial SSH logi= n > somehow so as not to force people to waste time modifying their image. > > But you're all right that on PRINCIPLE, it is correct to leave sshd > disabled for all accounts by default, not just the root. In this case, Ar= ch > Linux did it right by disabling ALL remote access. Only the person with > physical access is able to log in. > > A better way is to auto-configure root password on initial boot to > something random and flash the LEDs to display the password. That way, th= e > person who physically owns the device can login with a password that only > he knows (by looking at the status LEDs). > > In either case, there should be a way to log in through the network > somehow. > -- > http://www.piclist.com PIC/SX FAQ & list archive > View/change your membership options at > http://mailman.mit.edu/mailman/listinfo/piclist > --=20 int main() { char *a,*s,*q; printf(s=3D"int main() { char *a,*s,*q; printf(s=3D%s%s%s, q=3D%s%s%s%s,s,q,q,a=3D%s%s%s%s,q,q,q,a,a,q); }", q=3D"\"",s,q,q,a=3D"\\",q,q,q,a,a,q); } --=20 http://www.piclist.com PIC/SX FAQ & list archive View/change your membership options at http://mailman.mit.edu/mailman/listinfo/piclist .