1

I am currently operating a beaglebone as the control PC of a scientific instrument. In order to increase its potential, it is connected to the internet, currently without password, i.e. everyone who knows the IP and the username can directly connect to it and is admin. I know that is bad. What are the steps I can and have to do in order to make it more safe without removing it from the internet? OS is debian for beaglebone.

  • Is there a special reason you can't enable a password in the first instance anyway? – Rory Alsop Dec 3 '15 at 7:55
  • I just hope the instrument is not a research nuclear reactor. – Deer Hunter Dec 3 '15 at 8:34
  • @RoryAlsop: I just did not think about that, password is enabled now. If the attached instruments are not in use, then they are switched off, so the onliest damage can be the installation of a malicious program for remote-controlling it (DOS, etc.). – arc_lupus Dec 3 '15 at 9:10
3

The default installation of debian for the Beaglebone has a user named 'debian' and password is initially set to 'temppwd'.

The first thing you should do is log in as this user, change the password and set a root password. From a terminal or shell use the passwd command and follow the prompts to change the password.

Next, use the command sudo su to run with root privileges - you'll be prompted to enter the user password - and again use the command passwd to set a password for the root account.

With your passwords changed you should thereafter not log in via the root account unless you're performing actions that require administrative privileges. All services, for example a web or file server, should run from a non-privileged user. You can even create users to run services, to isolate services from one another.

You may also wish to remove the default user account from the sudoers file, which can be done by running the visudo command, deleting the entry for that account and saving the results.

1

What do you mean by "increasing its potential"? Is there an actual reason you've connected it to the internet?

If all that you need to do is access it from home then the quick and dirty answer is:

  • block everything but ssh with a firewall
  • Disable password logins
  • Use ssh keys to access it, from an unprivileged user
  • Use sudo to manage it
  • Enable automated security updates, because it's likely you'll just leave the Beaglebone running and forget about it (or move to a different project in six months)
  • Inform your IT department of it (depending on your policies, you might not be allowed to do that)
  • Perhaps change the SSH port to something non-standard. This won't add any security, but will reduce the amount of ssh probes that come from the internet; if you're managing a scientific instrument the last thing you want is a high CPU load due to e.g. ssh bruteforcing, while having to keep a realtime process running.

There is a whole literature on securing Debian systems. See for example this link.

Also, you might want to check the logs to make sure nobody logged in while it was connected. There's plenty of automated scanners that constantly try it.

  • It was one of the requirements when installing the whole setup, thus it is connected to the internet. – arc_lupus Dec 3 '15 at 10:06
  • 1
    @arc_lupus I strongly recommend you contact a security professional to inspect the device and secure it. I don't suppose the seller can do that..? – lorenzog Dec 3 '15 at 10:24
  • The seller just sold a standalone credit-card sized linux pc (such as the raspberry) – arc_lupus Dec 3 '15 at 10:31
  • @arc_lupus then I think you are on your own. Please make sure you lock down the device as much as you can, for the sake of data integrity and to protect against possible repercussions (e.g. an attacker uses the device to launch attacks against others, etc.) – lorenzog Dec 3 '15 at 11:00
  • @arc_lupus - the problem is you can't be sure the beaglebone hasn't been hacked already. You can hope it hasn't but you must plan for reinstalling the OS and all the software. – Deer Hunter Dec 3 '15 at 11:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.