2

Please excuse my ignorance. I have searched and I haven't found anything that addresses my question.

What is the purpose of auto-login and is it safe to enable?

I am using my Pi 3B to host a very light-weight RESTful API which I intend to expose through a port forwarder.

Is auto-login insecure for this situation?

Thanks in advance for your help

tinonetic
  • 133
  • 4

1 Answers1

9

Auto-login is simply a convenience feature. By default, on the local console or UI, it provides the ability to not have to enter your user password before continuing loading the user's environment.

It's insecure only if anyone else has direct, physical access to your Pi. Over SSH remotely, the user's password will still be required (so you definitely should change it, even if you don't have auto-login!). It doesn't affect a REST or other API (ie. web server) running on the Pi either.

So, to repeat, auto-login is a convenience, that only affects the person logging into the physical device.

Personally, I use it on all my Pis (I have numerous in various testing/development environments), but it's quite rare I use my Pis directly. Typically I set up SSH keys and connect remotely. Only time I use direct access is for network related changes. This allows me to have crazy passwords that I don't need to remember. On the console, it auto-logs in, and over SSH, I use identity keys.

stevieb
  • 1,466
  • 9
  • 11
  • Thank-you. I went ahead and disabled it, now I cannot SSH to it. Does it mean services such as SSH would not be running until I login or enable auto-login? – tinonetic Feb 03 '19 at 21:06
  • 1
    No. SSH shouldn't be affected by that change. Are you sure you didn't accidentally disable SSH? How did you make the change? In the config file, or through raspi-config? Also, did you do a reboot and your IP of the Pi changed? ie. How are you connecting via SSH? – stevieb Feb 03 '19 at 21:08
  • Yes, through raspi-config. I will re-try – tinonetic Feb 03 '19 at 21:08