Summary

As of now, VyOS uses a default user and password pair for its live CD (vyos/vyos). That is not a security problem in the default configuration, since all networking is disabled there. But it can become a problem very easily: boot a live CD, add an address, enable SSH — then realize that you forgot to change the password first and the system is wide open (and vyos/vyos has been in brute force attack password lists for a long time already).

It can also become a huge problem when the config is partially reset to default.

One possible approach is to generate the password for the vyos user randomly and display it in the console. The password should be easy to type, so pwgen is not a good choice. An approach described in XKCD#936 may work better, there are generators for that password style as well.

This system is unconfigured. You can log in with:
User: vyos
Password: correct-horse-battery-staple

login:

Use case

Any systems that do not use cloud-init will be a lot easier to keep secure without a default password.

Additional information

One question is what exactly should trigger the password generation sequence. One idea is to do that if authentication encrypted-password is missing from the config for vyos.