Services >> Terminal: Guest Account and Auto-Login, Set up sudo

Banana Pi Router design OpenWRT One(MT7981)/BPI-R2 Mini
1

Having to log-in to the Services >> Terminal each time you start it is a pain. But bypassing that password authentication opens a major security hole.

By default, using /bin/login -f root in luci-app-ttyd (under Services >> Terminal >> Config >> Command field) creates a major local security hole: anyone on your LAN can bypass LuCI entirely, point their browser to http://<router_ip>:7681, and drop straight into an unauthenticated root shell.

Let’s fix both of those problems.

Create a guest user:

echo “guest:x:1001:1001:guest:/var:/bin/ash” >> /etc/passwd

Register the User Group:

echo “guest:x:1001:” >> /etc/group

Set the guest account password:

passwd guest

Follow the prompts to enter the password for the guest account.

Under System >> Software, install sudo.

Grant sudo permissions (with password use) to the guest user:

echo “guest ALL=(ALL) ALL” > /etc/sudoers.d/guest

Secure the Permissions File:

chmod 0440 /etc/sudoers.d/guest

Set up auto-login to the guest account: Under Services >> Terminal >> Config >> Command field … enter:

/bin/login -f guest

Now, when you start Terminal, it will auto-login to the guest account.

If you try to do anything that requires sudo, such as:

sudo uci show network

… it will prompt you for the guest account password. Sudo remembers the password for a period of time, so you can then perform further sudo actions without having to re-enter the guest password.

If you need to do sudo work, you can type:

sudo -i

… enter the guest account password, and when you’re done, type:

exit

… which will drop you back to the guest account.

How It Works in Practice

Auto-Login: When you open the LuCI Terminal page, it will drop you straight into a command prompt (under the guest account) instantly without prompting for a username or password. Running whoami (if you’ve got that package installed) will show you are guest.

Safe LAN Exposure: If anyone snoops on port 7681 across your local network, they are entirely locked inside a restricted user environment with no rights to alter firewall rules, Wi-Fi configs, or packages.

Elevating Privileges: When you need to run an admin command, prefix it with sudo or drop to a root shell with sudo -i.

2

{ EDIT: updated to make the changes persist across reboots

/var is a symlink directly into the router’s volatile RAM (/tmp)

If you implemented the previous script, you don’t have to worry about cleaning up the old script… it’s flushed on router reboot. }

In Services >> Terminal, drop into a sudo shell (enter sudo -i, enter guest password), then paste this script in and press Enter:

cat << 'EOF' > /usr/bin/motd-temp.sh

#!/bin/sh
clear
# TRAP: If the user presses Ctrl+C (SIGINT), catch it, restore the cursor, and exit cleanly
trap 'printf "\033[?25h\n\n"; clear; trap - INT; return 2> /dev/null || exit' INT

while true; do
    printf "\r\033[?25l\033[KCore Temp: %s" "$(awk '{print $1/1000 " °C / " (($1/1000 * 1.8) + 32) " °F"}' /sys/class/thermal/thermal_zone0/temp)"

    read -t 5 input && break
done

# Clean cleanup for standard Enter press execution
printf "\033[?25h\n\n"
clear
trap - INT
EOF

Ensure the guest account has the ability to run the script:

chmod 755 /usr/bin/motd-temp.sh

Check where the guest user’s account is located:

grep guest /etc/passwd

Which should return:

guest:$5$PESZuFcajaWH0Xf4$kpUjgAyv6bwrhFrQTtFj99DPYFlXszpGUdcjXO1BpiB:1001:1001:guest:/var:/bin/ash

/var is volatile, so we’ll change the guest user’s account to persistent storage:

sed -i 's|:guest:/var:|:guest:/home/guest:|' /etc/passwd

grep guest /etc/passwd

Which should return:

guest:$5$PESZuFcajaWH0Xf4$kpUjgAyv6bwrhFrQTtFj99DPYFlXszpGUdcjXO1BpiB:1001:1001:guest:/home/guest:/bin/ash

Create the permanent home directory path

mkdir -p /home/guest

Ensure the actual activation file is in place inside that directory:

`echo "/usr/bin/motd-temp.sh" > /home/guest/.profile`

Secure the folder so the guest account cannot delete or alter its login profile

chown -R root:root /home/guest
chmod 755 /home/guest
chmod 644 /home/guest/.profile

Now, when you go to Services >> Terminal, it will immediately start monitoring temperature (under the guest account). You can press either Enter or Ctrl-C to drop back to the command prompt (under the guest accout).

So now I can do something like open my browser and enter:

http://192.168.1.1:7681

… which allows me to monitor OpenWRT One temperature (updating every 5 seconds). I can press Enter or Ctrl-C to drop to a command prompt (under the guest account).

Now it’s a simple matter of setting up a Favorites in your browser pointing to that URL. You could even set it so that each new tab starts up that OpenWRT One temperature monitoring page.