2

I want sudo to behave like this, for all users:

  1. If the user currently has a non-empty password, prompt for the password.

  2. If the user currently has an empty password, either prompt for the password and accept the empty string, or don't prompt at all and permit.

Is this possible? Right now, I have (1) but this is what happens for a user with an empty password:

$ sudo echo
Sorry, try again.
Sorry, try again.
Sorry, try again.
sudo: 3 incorrect password attempts

Alternatively, I can switch off password checking per-user, but that's not what I want, because the user might set a password later, and then sudo should prompt for it.

  • 4
    You want accounts that have no password to be able to run any command as root? Why bother having passwords at all for any account? You can just chmod ug+x /bin/su because that's the net effect of your desire. – msw Jun 27 '14 at 23:20
  • That fails condition 1. I want users to be prompted for a password if they have one. – Ashley Yakeley Jun 28 '14 at 0:28
  • 5
    @AshleyYakeley so they can just su to the account with no password and then sudo from there. – casey Jun 28 '14 at 3:22
6

I don't think this is possible because sudo will not know that a user doesn't have a password or that it's the empty string until it (sudo) presents the password, empty or otherwise, to the PAM module for validation. Therefore it will always need to request the password from the user, before proceeding.

Your only recourse here is to configure users that do not require the use of a password with the NOPASSWD option in your sudoers file. But this is highly insecure, and I'd recommend you seriously consider what your ultimate goal is here before proceeding with that method.

...so I don't care about security...

First set a "blank" password

This U&L Q&A titled: How do you create a user with no password? suggested using this method which worked for me.

$ sudo passwd --delete samtest
Removing password for user samtest.
passwd: Success

Now test it out

Now add a line like this to your /etc/sudoers file. NOTE: Always edit this file using sudo visudo.

samtest ALL=(ALL)       NOPASSWD: ALL

Now try logging in as user "samtest" without any password.

$ su - samtest
$ 

Now try using this account using sudo:

$ whoami
samtest

$ sudo echo

$ 
  • This will be running in a VM, with no security at all: there will be a default user with no password, auto-login, and root access. However, the user can set a password purely to protect themselves from their own mistakes. – Ashley Yakeley Jun 29 '14 at 0:34
  • @AshleyYakeley - are you making a standard type of system account that you'll distribute with the VM? If so I'd do the NOPASSWD for it in sudoers file then. – slm Jun 29 '14 at 0:36
  • I wouldn't mind sudo asking for a password, and the user just hitting enter, but it doesn't. It just gives the output above. – Ashley Yakeley Jun 29 '14 at 0:53
  • @AshleyYakeley - how did you set the password as blank? I'd do it using passwd <username>, or try other methods mentioned here: unix.stackexchange.com/questions/128/… – slm Jun 29 '14 at 0:56
  • @AshleyYakeley - see updates. – slm Jun 29 '14 at 1:50
0

It was an error in my PAM "auth" script: the script was terminating without ever getting an "ok" or "done".

0

Wondering why sudo via a console works while it prompts for a password over SSH?

At least on Ubuntu 16.04, the default policy in /etc/pam.d/common-auth contains:

auth    [success=1 default=ignore]      pam_unix.so nullok_secure

The pam_unix(8) manual documents that nullok_secure permits empty passwords only when using one of the TTYs in /etc/securetty. If this limitation is not desired, one could replace nullok_secure by nullok.

Alternatively one can allow one specific user to use empty passwords by means of a NOPASSWD sudoers file as described by slm.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.