Skip to contentSkip to conversation

New: Add dropbear config option to allow blank passwords

Buildroot bugzilla at busybox.net 4 participants 5 messages Apr 25, 2012 – May 26, 2013

lore
Share & tools
lore

bugzilla at busybox.net

author
#0 lore raw

https://bugs.busybox.net/show_bug.cgi?id=5138

Summary: Add dropbear config option to allow blank passwords
Product: buildroot
Version: unspecified
Platform: All
OS/Version: Linux
Status: NEW
Severity: enhancement
Priority: P5
Component: Other
AssignedTo: unassigned at buildroot.uclibc.org
ReportedBy: grant.b.edwards at gmail.com
CC: buildroot at uclibc.org
Estimated Hours: 0.0

Created attachment 4292
--> https://bugs.busybox.net/attachment.cgi?id=4292
Patch to add dropbear config option to allow blank passwords

Add a configuration option to allow enabling dropbear's ALLOW_BLANK_PASSWORD feature.

Signature · 3 lines
Configure bugmail: https://bugs.busybox.net/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
#1 lore raw
Quoted 17 lines · bugzilla at busybox.net

https://bugs.busybox.net/show_bug.cgi?id=5138

Summary: Add dropbear config option to allow blank passwords
Product: buildroot
Version: unspecified
Platform: All
OS/Version: Linux
Status: NEW
Severity: enhancement
Priority: P5
Component: Other
AssignedTo: unassigned at buildroot.uclibc.org
ReportedBy: grant.b.edwards at gmail.com
CC: buildroot at uclibc.org
Estimated Hours: 0.0

Quoted 6 lines

Created attachment 4292
--> https://bugs.busybox.net/attachment.cgi?id=4292
Patch to add dropbear config option to allow blank passwords

Add a configuration option to allow enabling dropbear's ALLOW_BLANK_PASSWORD feature.

this is a security issue

I prefer to add an option to add a default ssh public key

I've a patch somewhere

Best Regards,
J.

#2 lore raw
Quoted 18 lines · Jean-Christophe PLAGNIOL-VILLARD
Quoted 17 lines · bugzilla at busybox.net

https://bugs.busybox.net/show_bug.cgi?id=5138

Summary: Add dropbear config option to allow blank passwords
Product: buildroot
Version: unspecified
Platform: All
OS/Version: Linux
Status: NEW
Severity: enhancement
Priority: P5
Component: Other
AssignedTo: unassigned at buildroot.uclibc.org
ReportedBy: grant.b.edwards at gmail.com
CC: buildroot at uclibc.org
Estimated Hours: 0.0

Quoted 8 lines
Quoted 6 lines

Created attachment 4292
--> https://bugs.busybox.net/attachment.cgi?id=4292
Patch to add dropbear config option to allow blank passwords

Add a configuration option to allow enabling dropbear's ALLOW_BLANK_PASSWORD feature.

this is a security issue

Only if you set it (it defaults to "n") and the device in question is on an accessible network.

Quoted 1 line

I prefer to add an option to add a default ssh public key

That doesn't do the same thing.

Quoted 1 line

I've a patch somewhere

I've no objection to having an option for a default key, but I don't think it's buildroot's place to try to decide and enforce security policies. Those decisions belong to the person specifying and designing the embedded system.

[Not allowing blank passwords in dropbear seems especially silly when blank passwords are allowed by telnetd, login and openssh.]

Signature · 3 lines
Grant Edwards               grant.b.edwards        Yow! BARBARA STANWYCK makes
                                  at               me nervous!!
                              gmail.com
#3 lore raw

Le Wed, 25 Apr 2012 19:39:02 +0000 (UTC), Grant Edwards <[email protected]> a ?crit :

Quoted 11 lines
Quoted 1 line

this is a security issue

Only if you set it (it defaults to "n") and the device in question is on an accessible network.

Quoted 1 line

I prefer to add an option to add a default ssh public key

That doesn't do the same thing.

Quoted 1 line

I've a patch somewhere

Quoted 7 lines

I've no objection to having an option for a default key, but I don't think it's buildroot's place to try to decide and enforce security policies. Those decisions belong to the person specifying and designing the embedded system.

[Not allowing blank passwords in dropbear seems especially silly when blank passwords are allowed by telnetd, login and openssh.]

Agreed. I think both the "Allow blank passwords" option and the "Add default ssh public key" options make sense, and they both should be added.

Thomas

Signature · 4 lines
Thomas Petazzoni, Free Electrons
Kernel, drivers, real-time and embedded Linux
development, consulting, training and support.
http://free-electrons.com
author
#4 lore raw

[Buildroot] [Bug 5138] Add dropbear config option to allow blank passwords

In reply to bugzilla at busybox.net

https://bugs.busybox.net/show_bug.cgi?id=5138

Thomas Petazzoni <[email protected]> changed:

What |Removed |Added
----------------------------------------------------------------------------

             Status|NEW                         |RESOLVED
         Resolution|                            |INVALID

--- Comment #1 from Thomas Petazzoni <[email protected]> 2013-05-26 08:45:22 UTC --- Since https://secure.ucc.asn.au/hg/dropbear/rev/c58a15983808, the compile-time
option to allow blank password no longer exists. It has been replaced by the
runtime option -B.

Signature · 3 lines
Configure bugmail: https://bugs.busybox.net/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.