8

I'm running Jessie Pixel on my RP2 and every time I log in via SSH I get the message:

SSH is enabled and the default password for the 'pi' user has not been changed. This is a security risk - please login as the 'pi' user and type 'passwd' to set a new password.

Not even via SSH. When I log in to the GUI I get a warning box with the same error. I don't want to change the default password, even if I know it is a security risk. How can I prevent the warning message from appearing?

9

Method 1 (still recommended, even if you don't like it):

  • Change the password for the user pi

Method 2:

  • Remove the file /etc/profile.d/sshpasswd.sh (sshpwd.sh for stretch)

    It contains the code checking for the password and displaying the message (see this)


Notice:

Not even via SSH. When I log in to the GUI I get a warning box with the same error.

This message is meant to encourage you to take steps to protect your device from bots on the internet which constantly scan IP addresses trying the default user: pi password: raspberry on SSH port.

Regardless of what method you use to reach your system, the message warns you (it should be more explicit, imho) that these bots can log in to your system using the well-known default credentials and take control of your device.


Best practice:

Regardless of the message you should never* leave password-based authentication on SSH. Check the advice from Raspberry.SE moderator on how to improve the SSH Security and Usability: Part 1 and Part 2.

* and if for some obscure reason you think you must, you should limit it to a specific IP address and user in SSH daemon config.

  • sshpasswd.sh appears to now be sshpwd.sh – Jim Fred Mar 12 '17 at 0:43
-1

try this command

sudo sed -i 's/^\tcheck_hash/#\tcheck_hash\necho "";/' /etc/profile.d/sshpasswd.sh || fail

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.