I've been gently experimenting with
roles in Solaris, and wonder a bit about setting a
password for it.
I want the role I've created to be used by several users, so setting password to the same as one user (as is done for the root-role) is not an option. Having several users "sharing" (knowing) a single password, I've heard is a bad idea - that is after all the rational behind
So for now, I've set a blank password (just "Enter"). I did this not by leaving the field in
/etc/shadow blank nor by setting it to "NP"... I did it by using
passwd to set it to nothing (pressed "Enter" twice) - and the resulting encrypted entry was surprisingly long and garbeled.
So my first question; is it safe to leave a
role with blank ("Enter") as password? After all, only logged-in users with that role can assume it...
A few more questions:
Is there some way in the role-specification to specify that a user should authenticate with his own password - rather than the role's - to switch to the role (without changing the role's password to that of the user, as I assume is done with the root-role)? If not, are there other ways (eg. by using
sudo - maybe in combination with
su? If so, how?) to accomplish this?
How is the
root-role bound to the password of the "first user"? Is it some field in the role-specification that makes it happen automatically? What happens behind the scenes to make it happen?