Hardening

SSH

The image uses Dropbear, not OpenSSH.

ssh root@192.168.10.1   # default password root — change immediately
passwd

Disable for production:

systemctl disable dropbear
systemctl stop dropbear
# unit name may be dropbear.service — confirm with:
systemctl list-units '*dropbear*' '*ssh*'

Permanent removal is an image rebuild (IMAGE_FEATURES without ssh-server-dropbear) plus reflash. chmod 000 tricks are not a security control.

Management LAN

• Do not bridge br0 to a hostile network.
• Firewall or bind-restrict 9090, 50051, 8682, 80/443, plugin ports.
• Set allow_all_peers = false.
• Change default radio power/frequency to a legal profile before any outdoor TX.

Shipping OEM units

Use pre-deployment checklist.