ARM处理器产品Linux系统的密码与私钥存储策略咨询

Hey there! Let's tackle the password and private key strategy questions for your ARM-based Buildroot product—since it's targeted at enterprises with restricted physical access, we can focus on balancing rock-solid security with practicality for your authorized staff.

• Machine-generated, high-entropy passwords only: Skip manual password creation entirely—humans are terrible at picking strong, unique ones. Use a tool like pwgen -s 16 1 (integrate this into your Buildroot build workflow) to generate 16+ character passwords with mixed uppercase/lowercase letters, numbers, and safe special characters (avoid ", ', or \ to prevent SSH parsing issues).
• Per-device unique passwords: Never use a shared default password across all devices! Add a custom script to your Buildroot build that generates a unique password for each unit, then writes it securely to /etc/shadow. This way, a breach on one device won't put your entire fleet at risk.
• Enforce password expiration: Set a 90-day maximum password age with chage -M 90 <admin-user> to force staff to rotate credentials regularly. You can bake this into your Buildroot post-build scripts.
• Limit brute-force attempts: In your sshd_config, set MaxAuthTries 3 to cut off connections after 3 failed password attempts. This stops automated brute-force tools in their tracks.
• Lock down root password login: Create a dedicated admin user (e.g., devops) with sudo privileges, then disable root password login via SSH. In sshd_config, set PermitRootLogin prohibit-password so root can only access via private keys (or disable it entirely if staff don't need root SSH access).

• Use modern, secure key algorithms: Ditch outdated RSA keys (unless you have legacy compatibility needs) and go with ED25519 keys—they're faster, more secure, and shorter. Generate one with ssh-keygen -t ed25519 -C "enterprise-device-$(hostname)" during device first boot (not at build time, to avoid shared keys across devices).
• Secure device-side host key storage:
  • Store host keys on a read-only partition (configure Buildroot to mount /etc/ssh as read-only by default). If you need to rotate keys later, use an overlayfs to temporarily mount a writable layer over the partition.
  • Never set a passphrase on device host keys—SSH needs to start automatically on boot, and a passphrase would require manual intervention every time the device restarts.
• Client-side private key best practices:
  • Require your staff to set strong passphrases on their personal SSH keys (use ssh-keygen -p to add or update a passphrase). This prevents unauthorized access if a staff member's key file is lost or stolen.
  • Encourage use of enterprise-grade password managers to store client keys, rather than leaving them unprotected on local hard drives.
• Rotate host keys regularly: Add a cron job or systemd timer to generate new host keys every 6-12 months. This limits the window of opportunity if a key is compromised.
• Disable password login (optional but highly recommended): If your enterprise environment supports it, set PasswordAuthentication no in sshd_config to force SSH access via private keys only. This eliminates password-based attack vectors entirely.

• Secure UART access: Even with restricted physical access, don't let UART auto-login without authentication. Configure getty to prompt for a password on the serial TTY, or limit UART access to authorized users only.
• Buildroot configuration hardening: Enable BR2_PACKAGE_OPENSSH_SERVER_HARDENING in your Buildroot config to apply pre-built SSH security tweaks, and disable any unused system services to reduce your attack surface.
• Centralized logging: Forward SSH access logs to your enterprise's central log server. This lets you monitor for suspicious activity like repeated failed login attempts or access from unknown IPs.

内容的提问来源于stack exchange，提问作者naggety