1

I have a raspberry pi 3B v1.2 which I want to use as a headless server, downloaded a new version of raspbian jessie lite (2017-04-10), wrote it to the micro SD card, then created a new password with salt using this Python script :

$ python -c "import crypt, getpass, pwd; \
             print crypt.crypt('password', '\$6\$saltsalt\$')"

Then replaced the hash for user pi (which was for the old password 'raspberry') in /etc/shadow with the new one and then (unmounted and) put the SD card back in the raspberry, switched on, got network and tried to login with ssh.

The new password of which the hash now existed in the /etc/shadow file was not accepted, I still had to log in with the old password which very surprisingly was still valid.

I don't like to leave a raspberry with its default credentials open for attack on the internet upon its first boot. That's why I want to change the default password into something more difficult prior to its first boot.

What did I do wrong, and how can I obtain the goal of changing the password pre-emptively?

  • Wouldn't it be easier to boot up the first time without a network connection (disconnect the ethernet cable) and change the password, to as you say to prevent all kinds of bad things from happening. – Steve Robillard May 28 '17 at 22:18
  • Sorry, I totally forgot to mention it's a headless server. – HarryH May 28 '17 at 23:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.