I don't know about every Linux distribution but Kubuntu and all other distributions that I tried always require you to set non-empty password during installation. This password is required when you want to do any task that requires root privileges.

I've mainly used Windows before and user passwords can be empty there, this is convenient if you trust all the people who have access to your computer. If any program requires administrator privileges (analog of root) then Windows just shows popup and you can allow or disallow this program to get these privileges.

Why is the same not possible on Linux? For me, it looks like you are supposed to use Linux in some hostile environment where all your neighbors are trying to get access to your computer.

I always use simple one-digit password to not forget it.

Edit: Everyone and everywhere say that having no password on Linux is very bad idea, it is unsecure, etc. But Windows users generally don't have passwords. I'm using Windows for many years and it never caused any problems for me. I just want to understand why this is not the same on Linux. If there would be no password on Linux then I will still need to use sudo and click Yes when any program asks for root privileges. This way no program will get root privileges without my permission. This doesn't seem less secure for me. It only would be unsecure if there are some evil people around you who have access to your computer and want to damage your system, but this is usually not the case.

Please don't downvote, I'm not trying to start flame war about Linux vs. Windows or something. I just want to understand why things are made this way.

  • Take a look at this Ask Ubuntu Q&A titled: Can I set my user account to have no password?. Kubuntu derives from Ubuntu so many of the same methods work there as well. – slm Mar 1 '14 at 2:13
  • Computers are generally viewed as a protected item and need to have passwords to secure them. I think you're underselling Window's attempts to be secure too. It includes many of the same preventative measures by forcing users to have passwords and by using UAC, a firewall, etc. etc. – slm Mar 1 '14 at 2:16
  • Well Windows is so insecure that having a password doesn't help much. – orion Mar 12 '14 at 10:07
  • Unless you're never connecting to the Internet, you are using your computer in a hostile environment where all your neighbors are trying to get access to it. – mattdm Jan 10 '16 at 20:13

You can have users without passwords. It's just a very frowned upon practice.
The low level tools like passwd support it (passwd -d to make a password empty). But the high level friendly tools that are provided by the distribution are generally what don't allow it.

Keep in mind that linux and most distributions are designed first and foremost as a server operating system, with a secondary use as a desktop OS.

|improve this answer|||||
  • to use passwd simply type passwd -d at the command line, and it should ask you for your old password, and then enter a new one in twice – Jacob Minshall Mar 1 '14 at 4:10
  • Upvote anyway, but “linux… designed first… as a server operating system” is bluntly wrong. Linux was first designed as a terminal emulator for PCs with some functions of a Unix-like operating system. – Incnis Mrsi Sep 9 '15 at 19:39

The point is that, unlike MS-Windows, most Unix systems are installed with remote access capabilities (for example, an SSH server is run by default by practically every GNU/Linux distribution). In other words, by creating an account with an empty password you invite the whole world to log on to your machine. This is particularly bad with the root account, because the username of that account is already known to the attackers.

Assuming you want to run sshd (which I heartily recommend -- remotely managing your home machine, and copying files around the home network are very useful), here's some hardening advice:

  1. In the file /etc/ssh/sshd_config, set

    PermitRootLogin no

    and append

    AllowUsers [your username]

    This saves you from remote root logins, remote logins to system accounts, and also remote logins to accounts that don't need it. This change requires restarting sshd.

  2. In the file /etc/hosts.deny deny everything by default with the line

    ALL: ALL

  3. In /etc/hosts.allow, only permit access from the local host, and ssh access from acceptable hosts.

    ALL:, [::1]/128


    This example is for a standard home network. My personal "sshd:" line also adds the domain name of my employer, so I can log in from work. When I travel I modify this line.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.