Default users on dietpi Topic is solved

Have some feedback, questions, suggestions, or just fancy a chat? Pop it in here.
Post Reply
tekblupace

Default users on dietpi

Post by tekblupace »

Hey guys,

So first of all nice work on the DietPi OS, really very nice indeed. I think this will be super super cool when its also ready for the RPI3 64bit.

Anyway to my question:-
On your getting started tutorial it states that the default user and login are as stated blow.
username = root
password = dietpi

Obviously it is best practice to change the password here, but what your tutorial didn't mention is that there is also a default user defines as.
username = dietpi
password = dietpi

It may be worth mentioning this in the getting started, just so users have the awareness of the account.
Anyhoo, keep up the great work, really loving the build.

:-)
User avatar
Fourdee
Site Admin
Posts: 2782
Joined: Tue Feb 06, 2007 1:36 pm

Re: Default users on dietpi

Post by Fourdee »

tekblupace wrote:Hey guys,

So first of all nice work on the DietPi OS, really very nice indeed. I think this will be super super cool when its also ready for the RPI3 64bit.
Hi,

When RPi release an official stable 64bit image for RPi3, we will also do the same. We just dont have the time to invest in further testing as Stretch is our focus at the moment.

The DietPi user is for testing purposes only, hence why we don't mention it (aside from changelog). We are aiming to switch the root user to DietPi by default in the future:
https://github.com/Fourdee/DietPi/issues/896
If you find our project or support useful, then we’d really appreciate it if you’d consider contributing to the project however you can.
Donating is the easiest – you can use PayPal or become a DietPi patron.
eddy
Posts: 4
Joined: Tue May 29, 2018 2:40 pm

Re: Default users on dietpi

Post by eddy »

I was very surprised to learn about the default dietpi user.

This seems like a security vulnerability. Anybody using DietPi on a device that is accessible via ssh is opening themselves up to a "default login" attack vector, and many users are probably not aware this account exists by default since it is not mentioned much.

I think by default, the dietpi account should be disabled until such time as it is actually used by installation "quick start" guides/tutorials instead of root.

In the mean time, I'd recommend that everybody using DietPi run:

Code: Select all

passwd --delete dietpi
to prevent the dietpi account from being used unless you've explicitly configured an authorized_keys file for SSH.
User avatar
MichaIng
Site Admin
Posts: 2422
Joined: Sat Nov 18, 2017 6:21 pm

Re: Default users on dietpi

Post by MichaIng »

@eddy
You are right. Users should be aware of the "dietpi" user. On fresh DietPi images a user prompt already asks to change the password, but I made some rework about how we use and handle passwords: https://github.com/Fourdee/DietPi/pull/1825

On v6.9 update (and fresh installs) all users will face two prompts:
- one to set the initial password for new software installations, which is saved as plain text within dietpi.txt and overwrites the default "dietpi"
- one to set the login passwords for "root" and "dietpi", which should be handled independently and never saved as plain text anywhere

The prompts also include the above explanation, but I think I have to tune the wording a bid ;).
eddy
Posts: 4
Joined: Tue May 29, 2018 2:40 pm

Re: Default users on dietpi

Post by eddy »

Thanks for the prompt action on this.

It's interesting that you say "On fresh DietPi images a user prompt already asks to change the password"... I just recently found DietPi while searching for a lighter-weight SBC OS, and since finding it, have flashed the current builds for "fresh installs" on both a Raspberry Pi and an Odroid C2 and don't recall being prompted for any password changes.

In any case, it's great that v6.9 will improve this situation. Thanks again for quick response!
AdvancedFollower
Posts: 20
Joined: Wed Dec 20, 2017 6:42 pm

Re: Default users on dietpi

Post by AdvancedFollower »

MichaIng wrote: Wed Jun 06, 2018 3:54 am @eddy
You are right. Users should be aware of the "dietpi" user. On fresh DietPi images a user prompt already asks to change the password, but I made some rework about how we use and handle passwords: https://github.com/Fourdee/DietPi/pull/1825

On v6.9 update (and fresh installs) all users will face two prompts:
- one to set the initial password for new software installations, which is saved as plain text within dietpi.txt and overwrites the default "dietpi"
- one to set the login passwords for "root" and "dietpi", which should be handled independently and never saved as plain text anywhere

The prompts also include the above explanation, but I think I have to tune the wording a bid ;).
How can the same user, "dietpi" have two passwords, one stored in the textfile, and another stored normally in the shadow file? I was afraid t o change the dietpi user password, in case it would break some dietpi script. Doesn't really matter in my case since I only allow public key logins, and only for my user.
I agree the wording needs to be tuned :)
User avatar
MichaIng
Site Admin
Posts: 2422
Joined: Sat Nov 18, 2017 6:21 pm

Re: Default users on dietpi

Post by MichaIng »

The login password for users root and dietpi should not break any scripts, thus can and should be changed. Only one single software title needs root password to stay at "dietpi" (can't remember right now which one), since it is hard coded into the binary. We will see if using another library allows to change it afterwards, otherwise give clear hint that SSH for this device then must not be opened to the web.

As said, the password in dietpi.txt is only used as default for all new software installations which require e.g. web page or database login etc, but can and should changed of course after installation and initial login. This is just to make initial setup easier instead of remembering or look up different default passwords for all software titles or the need to have those installations interactive in some cases.
MichaelTew
Posts: 13
Joined: Mon Jun 04, 2018 2:21 am
Location: Virgin Islands
Contact:

Default users on dietpi

Post by MichaelTew »

hi,

Is it possible to have the NEAR operator used as default in searches?
ie I normally only want results where the word matches are near in a doc

thanks
dan
Post Reply