I want sudo to behave like this, for all users:

  1. If the user currently has a non-empty password, prompt for the password.

  2. If the user currently has an empty password, either prompt for the password and accept the empty string, or don't prompt at all and permit.

Is this possible? Right now, I have (1) but this is what happens for a user with an empty password:

$ sudo echo
Sorry, try again.
Sorry, try again.
Sorry, try again.
sudo: 3 incorrect password attempts

Alternatively, I can switch off password checking per-user, but that's not what I want, because the user might set a password later, and then sudo should prompt for it.

  • 4
    You want accounts that have no password to be able to run any command as root? Why bother having passwords at all for any account? You can just chmod ug+x /bin/su because that's the net effect of your desire.
    – msw
    Jun 27, 2014 at 23:20
  • That fails condition 1. I want users to be prompted for a password if they have one. Jun 28, 2014 at 0:28
  • 5
    @AshleyYakeley so they can just su to the account with no password and then sudo from there.
    – casey
    Jun 28, 2014 at 3:22

3 Answers 3


I don't think this is possible because sudo will not know that a user doesn't have a password or that it's the empty string until it (sudo) presents the password, empty or otherwise, to the PAM module for validation. Therefore it will always need to request the password from the user, before proceeding.

Your only recourse here is to configure users that do not require the use of a password with the NOPASSWD option in your sudoers file. But this is highly insecure, and I'd recommend you seriously consider what your ultimate goal is here before proceeding with that method.

...so I don't care about security...

First set a "blank" password

This U&L Q&A titled: How do you create a user with no password? suggested using this method which worked for me.

$ sudo passwd --delete samtest
Removing password for user samtest.
passwd: Success

Now test it out

Now add a line like this to your /etc/sudoers file. NOTE: Always edit this file using sudo visudo.

samtest ALL=(ALL)       NOPASSWD: ALL

Now try logging in as user "samtest" without any password.

$ su - samtest

Now try using this account using sudo:

$ whoami

$ sudo echo

  • This will be running in a VM, with no security at all: there will be a default user with no password, auto-login, and root access. However, the user can set a password purely to protect themselves from their own mistakes. Jun 29, 2014 at 0:34
  • @AshleyYakeley - are you making a standard type of system account that you'll distribute with the VM? If so I'd do the NOPASSWD for it in sudoers file then.
    – slm
    Jun 29, 2014 at 0:36
  • I wouldn't mind sudo asking for a password, and the user just hitting enter, but it doesn't. It just gives the output above. Jun 29, 2014 at 0:53
  • @AshleyYakeley - how did you set the password as blank? I'd do it using passwd <username>, or try other methods mentioned here: unix.stackexchange.com/questions/128/…
    – slm
    Jun 29, 2014 at 0:56
  • @AshleyYakeley - see updates.
    – slm
    Jun 29, 2014 at 1:50

Wondering why sudo via a console works while it prompts for a password over SSH?

At least on Ubuntu 16.04, the default policy in /etc/pam.d/common-auth contains:

auth    [success=1 default=ignore]      pam_unix.so nullok_secure

The pam_unix(8) manual documents that nullok_secure permits empty passwords only when using one of the TTYs in /etc/securetty. If this limitation is not desired, one could replace nullok_secure by nullok.

Alternatively one can allow one specific user to use empty passwords by means of a NOPASSWD sudoers file as described by slm.


It was an error in my PAM "auth" script: the script was terminating without ever getting an "ok" or "done".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.