-2

If I have a Raspberry Pi, and I install noobs on it. If i connect it to my router and log in with the default user pi over ssh to create another user to then delete the pi user, is it secure?

Since the Pi was never port forwarded the ssh is just accessible over my local network and there should be nothing to worry about correct?

Its only when I port forward to the outside is the device at risk?

  • 1
    What you mean by port forward to the outside? – mentallurg Jun 24 '18 at 17:38
2

It depends how you secure the remaining user(s). Ideally you would disallow password authentication and use a strong public key authenticator instead.

Even on a local network, there's a risk that someone could bounce off a vulnerability with another device (say malware on a guest's cell phone, or a wi-fi connected lightbulb), and then breach the Raspberry Pi from there.

In the current security landscape, I would assume that any device connected to your network that you aren't patching regularly is a potential entry-point for an attacker.

If the Raspberry Pi is the only device on the network, then your assumption about the safety of devices that aren't port forwarded is mostly true. But that is rarely the case.

1

SSH is secure, if used correctly. You should really worry if there are ways to log in to your Pi via default pi/raspberry password.

You don't need to delete standard user, all you need to do is to generate RSA/ECC key for your machine, add it to .authorized_keys, test the connection and prohibit password login (set PasswordAuthentication no in /etc/ssh/sshd_config).

While your Pi is not configured consider it a newborn baby. It might survive for a bit in unsafe conditions, but we should really put it in sterile quarantined place. For example disconnect your internet, or connect Raspberry Pi directly to your machine while configuring.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.