Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?
I was testing my system's security when I discovered this.

   * What exactly did you do (or not do) that was effective (or
     ineffective)?
I invoked this command: sudo service ssh stop

   * What was the outcome of this action?
Success but not enough. The command stopped the ssh service successfully but inexperienced users are probably not aware of this.

   * What outcome did you expect instead?
The ssh service should be disabled by default because an attacker could exploit this.         
The Live DVD comes with a default username and password making the threat very real.


*** End of the template - remove these template lines ***
----

Sent using Crazymailing.com

I think that's actually more a general problem of Debian, i.e. that it
enables most services right at installing the package, which is
security-wise typically very bad, since the package is usually yet
unconfigured (or perhaps just "half configured" e.g. by debconf).

So this situation is quite unfortunate and actually has IMHO already
lead to unnecessary security holes in the past.

But when I've brought up the issue in past "security realted"
discussions on debian-devel, the (loud) majority seem to have preferred
works-somehow-out-of-the-box™ than works-securely.
It's even worse in the sense that the entropy used to generate the host
keys will be typically very low,.. at least right after boot.
So the keymaterial could be bad either.

Anyway, what do you mean with default username/password? root? Or the
normal user?
Cause as for root, Debian's current default SSH config should allow
login only "without-password".


Cheers,
Chris.