Everyone and everywhere say that having no password on Linux is very bad idea
A novel could be typed on this subject and even then would still be debatable as it is largely a matter of context.
If you're linux workstation is in a protected server room, having a man-trap entry, badged access, with armed guards at the facility, and the workstation has no network connection, then there is plenty of security in place such that a blank password or passwordless login is basically irrelevant. Also keeping in mind the software installed and the administration policies in place on this kind of standalone system. So, never say never (or always).
More realistic: you're home pc on the internet with no real important data, with maybe the exception of credit card information if you bought something online. In this case, what would an attack vector look like... malicious website getting their code to run through various ways from the web browser and all that may need to happen then is they
su with a blank password to gain root access and do anything. Therefore, a blank password especially for root, in this context, is bad.
SSH is a standard today, and is enabled by default, albeit with
PermitRootLogin no in the
sshd_config file. First thing I (or anyone) would do, with ssh, telnet, ftp, is try to access your system on the network with a login name of root and a blank password. If that works, shame on you not the bad guy.
Generally speaking: all typical users in linux are restricted users. Having a strong root password, if that restricted account has a blank or passwordless login then the damage should be contained to whatever that account has permissions to... provided all other security mechanisms are in place in linux, reasonably speaking. And I'm sure plenty of people can poke holes in this.
you said a one digit password. Well that is better than empty statistically speaking, where it is likely an empty password would be tried first so then you're maybe looking at odds of 1 in around 90 the choices on the keyboard. Now in the case of sitting at the terminal in a protected area for a computer not on the network then having to guess that (while also having a 15 minute or indefinite account lockout after 3 failed passwords) one can argue a one character password could be fine. But give anyone a password hash of a one-character password, they can crack it in possibly minutes so in knowing how online communication works with handshaking and all that a one character password would basically save you for 30 minutes versus 0 minutes of a blank password once someone gets that password hash.
I can speak for SLES 11 and RHEL 7, you certainly can have blank passwords even for the root account. And I'm sure this can happen in any linux. By default any linux distribution enforces a password policy so you have to go out of your way now to allow a blank password to be allowed. Not that it's a big deal, most linux today have standardized on using PAM (pluggable authentication modules) and is located under
/etc/pam.d/ For example somewhere in there if using nullok allows blank passwords- for the local linux account. SSH for example look into
I've mainly used Windows before and user passwords can be empty there, this is convenient if you trust all the people who have access to your computer. If any program requires administrator privileges (analog of root) then Windows just shows popup and you can allow or disallow this program to get these privileges. Why is the same not possible on Linux?
Windows and Linux are two different operating systems, so it is a bit of an apples to rock comparison. But the same certainly is possible in linux, one would just have to know how to undo the default security settings that are in place and these will vary between linux distributions. Off top of my head a
visudo and changing
root ALL=(ALL) ALL to
* ALL=(ALL) NOPASSWD: ALL would give every account root permission.