WARNING DEFAULT SSH PASSWORD

[elated-emu]

WARNING DEFAULT SSH PASSWORD

[a4004]

Hi @elated-emu

It seems that Umbrel's new update mechanism is at fault here. Since version 1.0 they have switched to Mender which is an image based update solution, and for some reason it seems the update includes the /etc/shadow file which effectively resets the password to the default one until the Umbrel daemon changes it back after the user logs in.

This should probably be a simple fix, ie just to omit the /etc/shadow file from the Mender update package. If that isn't possible, then maybe SSH should be disabled until the password is changed back after the update.

The vulnerability affects SSH and physical logins from any IP range including Docker, etc. I've provided more details in the Discord channel relating to this issue. <#1254380706105135175>