Why user and root passwords cannot be empty on Linux?

Question

I don't know about every Linux distribution but Kubuntu and all other distributions that I tried always require you to set non-empty password during installation. This password is required when you want to do any task that requires root privileges.

I've mainly used Windows before and user passwords can be empty there, this is convenient if you trust all the people who have access to your computer. If any program requires administrator privileges (analog of root) then Windows just shows popup and you can allow or disallow this program to get these privileges.

Why is the same not possible on Linux? For me, it looks like you are supposed to use Linux in some hostile environment where all your neighbors are trying to get access to your computer.

I always use simple one-digit password to not forget it.

Edit: Everyone and everywhere say that having no password on Linux is very bad idea, it is unsecure, etc. But Windows users generally don't have passwords. I'm using Windows for many years and it never caused any problems for me. I just want to understand why this is not the same on Linux. If there would be no password on Linux then I will still need to use sudo and click Yes when any program asks for root privileges. This way no program will get root privileges without my permission. This doesn't seem less secure for me. It only would be unsecure if there are some evil people around you who have access to your computer and want to damage your system, but this is usually not the case.

Please don't downvote, I'm not trying to start flame war about Linux vs. Windows or something. I just want to understand why things are made this way.

Answer 1

You can have users without passwords. It's just a very frowned upon practice.
The low level tools like passwd support it (passwd -d to make a password empty). But the high level friendly tools that are provided by the distribution are generally what don't allow it.

Answer 2

The point is that, unlike MS-Windows, most Unix systems are installed with remote access capabilities (for example, an SSH server is run by default by practically every GNU/Linux distribution). In other words, by creating an account with an empty password you invite the whole world to log on to your machine. This is particularly bad with the root account, because the username of that account is already known to the attackers.

Assuming you want to run sshd (which I heartily recommend -- remotely managing your home machine, and copying files around the home network are very useful), here's some hardening advice:

1. In the file /etc/ssh/sshd_config, set

   PermitRootLogin no

   and append

   AllowUsers [your username]

   This saves you from remote root logins, remote logins to system accounts, and also remote logins to accounts that don't need it. This change requires restarting sshd.

2. In the file /etc/hosts.deny deny everything by default with the line

   ALL: ALL

3. In /etc/hosts.allow, only permit access from the local host, and ssh access from acceptable hosts.

   ALL: 127.0.0.1, [::1]/128

   sshd: 192.168.0.0/16

   This example is for a standard home network. My personal "sshd:" line also adds the domain name of my employer, so I can log in from work. When I travel I modify this line.

Answer 3

Everyone and everywhere say that having no password on Linux is very bad idea

A novel could be typed on this subject and even then would still be debatable as it is largely a matter of context.

If you're linux workstation is in a protected server room, having a man-trap entry, badged access, with armed guards at the facility, and the workstation has no network connection, then there is plenty of security in place such that a blank password or passwordless login is basically irrelevant. Also keeping in mind the software installed and the administration policies in place on this kind of standalone system. So, never say never (or always).

More realistic: you're home pc on the internet with no real important data, with maybe the exception of credit card information if you bought something online. In this case, what would an attack vector look like... malicious website getting their code to run through various ways from the web browser and all that may need to happen then is they su with a blank password to gain root access and do anything. Therefore, a blank password especially for root, in this context, is bad.

SSH is a standard today, and is enabled by default, albeit with PermitRootLogin no in the sshd_config file. First thing I (or anyone) would do, with ssh, telnet, ftp, is try to access your system on the network with a login name of root and a blank password. If that works, shame on you not the bad guy.

Generally speaking: all typical users in linux are restricted users. Having a strong root password, if that restricted account has a blank or passwordless login then the damage should be contained to whatever that account has permissions to... provided all other security mechanisms are in place in linux, reasonably speaking. And I'm sure plenty of people can poke holes in this.

you said a one digit password. Well that is better than empty statistically speaking, where it is likely an empty password would be tried first so then you're maybe looking at odds of 1 in around 90 the choices on the keyboard. Now in the case of sitting at the terminal in a protected area for a computer not on the network then having to guess that (while also having a 15 minute or indefinite account lockout after 3 failed passwords) one can argue a one character password could be fine. But give anyone a password hash of a one-character password, they can crack it in possibly minutes so in knowing how online communication works with handshaking and all that a one character password would basically save you for 30 minutes versus 0 minutes of a blank password once someone gets that password hash.

I can speak for SLES 11 and RHEL 7, you certainly can have blank passwords even for the root account. And I'm sure this can happen in any linux. By default any linux distribution enforces a password policy so you have to go out of your way now to allow a blank password to be allowed. Not that it's a big deal, most linux today have standardized on using PAM (pluggable authentication modules) and is located under /etc/pam.d/ For example somewhere in there if using nullok allows blank passwords- for the local linux account. SSH for example look into /etc/pam.d/sshd

I've mainly used Windows before and user passwords can be empty there, this is convenient if you trust all the people who have access to your computer. If any program requires administrator privileges (analog of root) then Windows just shows popup and you can allow or disallow this program to get these privileges. Why is the same not possible on Linux?

Windows and Linux are two different operating systems, so it is a bit of an apples to rock comparison. But the same certainly is possible in linux, one would just have to know how to undo the default security settings that are in place and these will vary between linux distributions. Off top of my head a visudo and changing root ALL=(ALL) ALL to * ALL=(ALL) NOPASSWD: ALL would give every account root permission.