armbian: default to SSH disabled

armbian.sh

@@ -30,6 +30,9 @@ curl -sSL https://raw.githubusercontent.com/nextcloud/nextcloudpi/master/install
 # force change root password at first login (again)
 chage -d 0 root
 
+# disable SSH by default, it can be enabled through ncp-web
+systemctl disable sshd
+
 
 # License
 #

build-SD-rpi.sh

@@ -63,6 +63,11 @@ PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
     # harden SSH further for Raspbian
     sed -i 's|^#PermitRootLogin .*|PermitRootLogin no|' /etc/ssh/sshd_config
 
+    # default user 'pi' for SSH
+    sed -i 's|^USER_=.*|USER_=pi|'              /usr/local/etc/ncp-config.d/SSH.sh
+    sed -i 's|^PASS_=.*|PASS_=raspberry|'       /usr/local/etc/ncp-config.d/SSH.sh
+    sed -i 's|^CONFIRM_=.*|CONFIRM_=raspberry|' /usr/local/etc/ncp-config.d/SSH.sh
+
     rm -rf /tmp/ncp-build
 EOFCHROOT
 

etc/ncp-config.d/SSH.sh

@@ -8,21 +8,22 @@
 #
 
 ACTIVE_=no
-USER_=pi
-PASS_=raspberry
-CONFIRM_=raspberry
+USER_=root
+PASS_=1234
+CONFIRM_=1234
 
 DESCRIPTION="Activate or deactivate SSH"
 INFOTITLE="SSH notes"
-INFO="In order to enable SSH, the password for user pi can NOT remain set to the default raspberry. 
-You HAVE to create a NEW password for pi if you want this program to enable SSH, it will fail if you dont!
+INFO="In order to enable SSH, the password for user 'pi' can NOT remain set to the default raspberry. 
+You HAVE to create a NEW password for 'pi' if you want this program to enable SSH, it will fail if you dont!
+The same will happen with user 'root' and password '1234'
 Note: Use normal AlphaNumeric, the only special characters allowed are .,@-_/"
 
 install() { :; }
 
 is_active()
 {
-  systemctl status ssh &>/dev/null
+  systemctl -q is-enabled ssh &>/dev/null
 }
 
 configure() 
@@ -39,6 +40,10 @@ configure()
     echo "Refusing to use the default Raspbian user and password. It's insecure"
     return 1
   }
+  [[ "$USER_" == "root" ]] && [[ "$PASS_" == "1234" ]] && {
+    echo "Refusing to use the default Armbian user and password. It's insecure"
+    return 1
+  }
 
   # Change credentials
   id "$USER_" &>/dev/null || { echo "$USER_ doesn't exist"; return 1; }
@@ -59,6 +64,21 @@ configure()
     }
   }
 
+  # Check for insecure default root password ( taken from old jessie method )
+  local SHADOW="$( grep -E '^root:' /etc/shadow )"
+  test -n "${SHADOW}" && {
+    local SALT=$(echo "${SHADOW}" | sed -n 's/root:\$6\$//;s/\$.*//p')
+    local HASH=$(mkpasswd -msha-512 1234 "$SALT")
+
+    grep -q "${HASH}" <<< "${SHADOW}" && {
+      systemctl stop    ssh
+      systemctl disable ssh
+      echo "The user root is using the default password. Refusing to activate SSH"
+      echo "SSH disabled"
+      return 1
+    }
+  }
+
   # Enable
   chage -d 0 "$USER_"
   systemctl enable ssh