[Buildroot] [Bug 5138] New: Add dropbear config option to allow blank passwords

[Thomas Petazzoni <thomas.petazzoni@free-electrons.com>]

Le Wed, 25 Apr 2012 19:39:02 +0000 (UTC),
Grant Edwards <grant.b.edwards@gmail.com> a ?crit :

> > this is a security issue
> 
> Only if you set it (it defaults to "n") and the device in question is
> on an accessible network.
> 
> > I prefer to add an option to add a default ssh public key
> 
> That doesn't do the same thing.
> 
> > I've a patch somewhere
> 
> I've no objection to having an option for a default key, but I don't
> think it's buildroot's place to try to decide and enforce security
> policies.  Those decisions belong to the person specifying and
> designing the embedded system.
> 
> [Not allowing blank passwords in dropbear seems especially silly when
> blank passwords are allowed by telnetd, login and openssh.]

Agreed. I think both the "Allow blank passwords" option and the "Add
default ssh public key" options make sense, and they both should be
added.

Thomas
-- 
Thomas Petazzoni, Free Electrons
Kernel, drivers, real-time and embedded Linux
development, consulting, training and support.
http://free-electrons.com