I am currently operating a beaglebone as the control PC of a scientific instrument. In order to increase its potential, it is connected to the internet, currently without password, i.e. everyone who knows the IP and the username can directly connect to it and is admin. I know that is bad. What are the steps I can and have to do in order to make it more safe without removing it from the internet? OS is debian for beaglebone.
The default installation of debian for the Beaglebone has a user named 'debian' and password is initially set to 'temppwd'.
The first thing you should do is log in as this user, change the password and set a root password. From a terminal or shell use the
passwd command and follow the prompts to change the password.
Next, use the command
sudo su to run with root privileges - you'll be prompted to enter the user password - and again use the command
passwd to set a password for the root account.
With your passwords changed you should thereafter not log in via the root account unless you're performing actions that require administrative privileges. All services, for example a web or file server, should run from a non-privileged user. You can even create users to run services, to isolate services from one another.
You may also wish to remove the default user account from the sudoers file, which can be done by running the
visudo command, deleting the entry for that account and saving the results.
What do you mean by "increasing its potential"? Is there an actual reason you've connected it to the internet?
If all that you need to do is access it from home then the quick and dirty answer is:
- block everything but ssh with a firewall
- Disable password logins
- Use ssh keys to access it, from an unprivileged user
sudoto manage it
- Enable automated security updates, because it's likely you'll just leave the Beaglebone running and forget about it (or move to a different project in six months)
- Inform your IT department of it (depending on your policies, you might not be allowed to do that)
- Perhaps change the SSH port to something non-standard. This won't add any security, but will reduce the amount of ssh probes that come from the internet; if you're managing a scientific instrument the last thing you want is a high CPU load due to e.g. ssh bruteforcing, while having to keep a realtime process running.
There is a whole literature on securing Debian systems. See for example this link.
Also, you might want to check the logs to make sure nobody logged in while it was connected. There's plenty of automated scanners that constantly try it.