Password for embedded devices in automatic deployment

Question

We are working with commercial embedded devices, where we install our software. Then, they are deployed in different client sites. The embedded devices have an Ethernet port and a console port for debugging and recovery. They are connected to the Internet and we need to access them remotely using ssh.

By default, the devices have a linux user and a password set by the manufacturer. Currently, we change that password manually and use it for ssh access and sudo instructions. Moreover, we set a password for root user to avoid getting locked out in emergency mode. Our clients never access the device, we are the only ones. As a result, there will no to be a user-generated password. Moreover, we want to maintain the option to use the debugging port in case of need.

Now, we are planning to scale. Therefore, we would like to automate the password setting.

I have been reading some other questions about passwords in embedded devices (1, 2) but they deal mostly with how to choose the password and not with how to set it. Also, in the answer to this question, it is suggested to use ssh with public-key cryptography instead of passwords. However, even if we stop using our user password for ssh, we still need to set a password to override the manufacturer's one that can be used in the debugging port.

I have come up with a possible solution for what to do when deploying a new device:

1. Generate a password in our server. It will be stored there for us to check it if needed.
2. Deploy our setup script in the device and have it reach our server for the password to set.

OR

2. Send a text file with the password to the device, to be deleted after initial setup.

What is the best option for step 2?

Is there a better procedure for password management in this scenario?

Answer 1

In beginning I should mention password is not good security solution.

As per your explanation you are want to access device some times, and no user is login to that particular device.

Your password or security management should be based on data you are processing or storing on device. In addition to that you might have legal bindings as well.

You can use synchronous password. Google authenticator app use same technology. If you need highly secured password, generate dynamic password on your server and synchronize time to time. Time duration can be vary 1 minute to 1 hour/day. Then even password is disclose after specific time period it will be disabled. This is required to have proper time synchronization mechanism between server and client.

Asynchronous password management also possible for device authentication, This is not time based and purely based on algorithm. Until password is used, it will be active. Password can generate with specific hardware devices. It does not require connectivity between devices and hardware token.

But both of these technologies are using secondary factory of multi-factor authentication. But i think this will be okay.

Answer 2

Without elaborating the weakness of the password to brute force attack, you may try next:

Since the device comes with predefined factory password, you can use it in a script that automatically connects to a range of devices (you can scan all dhcp pool, or get a list from dhcp server). After that the script can change the password in the device using some random function of generating string of predefined size and printing the device mac address and the password to a file.

For getting additional ideas you can read about CISCO TCL or Microsoft LAPS.