Take the 2-minute tour ×
Raspberry Pi Stack Exchange is a question and answer site for users and developers of hardware and software for Raspberry Pi. It's 100% free, no registration required.

Are there any security implications for creating (or not creating) a new user?

If need be, how do I create a new user or change the default user?

share|improve this question
    
Completely up to you. There are no security issues in creating a new user. Personally I would immediately change it to my own name. –  Jivings Jun 18 '12 at 19:01
    
Is this Debian specific? Does Arch ship with a default user? –  Alex Chamberlain Jun 19 '12 at 6:33
    
@AlexChamberlain: Arch only has root. You have to create additional users. –  Jivings Jun 19 '12 at 8:51
    
Either way, this really is specific to the software, not to the PI and should really be in the title. –  XTL Aug 23 '12 at 6:09
add comment

4 Answers

up vote 13 down vote accepted

Debian

The official Debian image ships with at least 2 users, root and pi. You will only be able to login to the pi account.

How do I change pi's password?

At the very least, you should change the password for the pi account, as anybody with a RPi will be able to log onto yours. To do this, run passwd from the command line and follow the prompts.

How do I change pi's username?

If, like me, you want to use your own name, you want to use usermod like this:

usermod -l newname -d newname -m oldname

There are more options for usermod, which can be found by running man usermod.

Should I set a password for root?

Debian's root does not have a password and is inactive - you cannot login to it or su to root. You should not change this, as it is a security risk and sudo is more secure.

So, are my files secure once I change the password?

Don't be too relaxed with your RPi's security though, the filesystem is not encrypted, by default, and therefore, anyone with physical access can just remove the SD card and read it using another machine.

Related questions

share|improve this answer
    
usermod replies user pi is currently used by process 10190 when I run usermod -l morgan -d morgan -m pi (process 10190 is bash, the shell I am running). I cannot login as root because I don't know its password. Is it necessary to create a temporary user to change the pi's username? –  Morgan Courbet Oct 21 '12 at 15:04
2  
@Morgan Set the password for root by running sudo passwd. –  Alex Chamberlain Oct 21 '12 at 16:23
add comment

Arch

A fresh Arch install ships with only the root user available. Thus you should definitely be creating a new user, as spending too much time as root is dangerous. In addition, you should also change the root password, as leaving as default is a major security risk.

Changing the root password

The password can be changed when logged in as root by running the passwd command.

# passwd
Changing password for root.
(current) UNIX password: 
Enter new UNIX password:
Retype new UNIX password:

Adding a new user

A new user can be created with the adduser or useradd commands. adduser is probably easiest, the only required field is the name (you can skip the others by pressing enter):

# adduser
Login name for new user []: 

You will be prompted for a new password for the account when it is created.

sudo

If you prefer, you can use sudo, in a similar way to Debian users.

Installation

To install sudo, run

pacman -S sudo

as root.

Use

To allow a user to use sudo they need to be added to the sudoers file. This can be done in two ways.

  • Add the user to the wheel group using usermod and uncomment this line in the sudoers file:

    %wheel ALL=(ALL) ALL
    
  • or add the user directly to the sudoers file:

    username ALL=(ALL) ALL
    

NOTE You should never edit the sudoers file with Vim, Emacs, etc. You should always edit it via visudo. This prevents you from messing up the syntax and rendering sudo unusable for you.

Disable Root

If you want to you can effectively disable the root account by running this command as root:

# passwd --lock

This option disables a password by changing it to a value which matches no possible encrypted value.

This shouldn't really be necessary if you have a strong root password and have root access through SSH disabled.

share|improve this answer
add comment

Extra trick on raspbian with usermod

usermod command won't run if there are any processes of the to-be-changed user running on the machine when the command is run.

If your on console of the pi there is a way to get around this without having to make another user (or set a pw on root):

Assuming nothing else is running with your username other then the shell on the console - no X session, no ssh login, etc:

exec sudo -s
cd /
usermod -l newname -d /home/newname -m oldname

The reason this works:

  • sudo -s tells sudo that instead of just running on command as another user that it should run new shell as the given user
  • exec tells the shell that instead of spawning off a new process when it runs a command (hence leaving the shell process running as the login user) that the shell should overwrite itself with the new process - this means that when exec ed command ends the shell is gone - in the case of a login shell that equates to disconnecting from the login
  • the cd / is optional. At minimum, things get a bit confusing if you move a dir your in (your login starts out sitting in the user pi home dir) but sometimes will cause a fail, better safe then sorry.

Therefor with exec sudo -s your overwriting your shell with a new shell that has been created as a different user.

P.S. be sure to give usermod -d a full path or you'll end up moving the account's home to somewhere you don't expect (and have a bogus directory entry in passwd)

share|improve this answer
add comment

I have been reading a bunch of how tos on this, but the easiest is also the simplest

login as pi

add new user

 sudo adduser john

after successful creation add john to sudoers group

 sudo usermod john -g sudo

log out as pi

login as john

try to update package list

 sudo apt-get update

if it works, you're done...

share|improve this answer
    
What if he's using Arch? –  Impulss Mar 16 '13 at 1:23
    
After running "sudo adduser guest", "passed" and creating folder /home/guest I've got a working guest user. However, when I log in as that user the .bashrc file in /home/guest doesn't seem to get executed. I've created .bashrc manually and granted execute permission on it. Is there something missing still? –  mvmn Feb 13 at 15:32
    
P.S. OK, I've solved it myself - .bashrc was sourced by .profile, and .profile did not exist for new user. –  mvmn Feb 13 at 15:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.