Redpitaya Forum

Hello,

I recently bought the RedPitaya for our electronic lab, as I found it could turn out to be an incredibly useful device for automated test equipment development. So I am not using it in my home network, however, in a big company network with thousands of other users in the same network. Therefore I am (and the network department are) slightly concerned about access control on the RedPitaya.

Do I get it right that:

• The RedPitaya runs on tiny Linux derivate with one user, being "root" and password "root"
• If I connect it to the network with DHCP potentially anybody inside this network could SSH into it with this standard username/password?
• This person could then do whatever he/she wants with it (like, installing different software, just clocking up the network, etc.)

Is there an easy way to change the root password (like just executing "passwd" in the shell)? This might cure most of the security concerns.

I could set it up with the wireless dongle and choose the WPA2 password to access it, which would somehow make it a bit more "secure", still, eventually I want the RedPitaya to connect to the internet within the company network.

Are there any better suggestions, experience? Or am I overly concerned...?

Hi,

larndoc wrote:Do I get it right that: ...

Correct on all counts, although there are other user accounts besides root (none of which have login permissions).

larndoc wrote:Is there an easy way to change the root password (like just executing "passwd" in the shell)?

You can change the root pw with "passwd" but it will only last until the next reboot, because the password-hash store (/etc/shadow) is restored from the ramdisk image.

The only persistent way to change the root password is to change the file inside the ramdisk image. I know of no easy way to do that, but that does not mean there isn't one ;O)

A not-easy way would be to set a different password in OS/buildroot/config , line 191 and rebuild the ecosystem. There are a couple of other things that could be done to increase security, eg. disabling remote login for root, setting up restricted accounts for remote login, etc. As with the generic root password, doing that would involve changes to the buildroot setup.

Won't files added to the buildroot/overlay directory be included in the ramfs image? If so, another option is to add a /root/.ssh/authorized_keys2 file with an SSH public key you've generated; any user without the corresponding key couldn't get into it.