[ this is a follow-up on my post on ServerFault : https://serverfault.com/questions/661136/root-accepts-any-password-how-to-change-to-a-real-password ]
On an old system the root account accepts any password, as long as it's not empty. Any password was accepted as the correct password, so anyone could login.
In the past (more than 10 years ago) this wasn't a problem as the system was behind a dial-up modem with its own authentication ... but since a few years the system can be reached via a public IP address.
Miraculously noone ever bothered with its SSH port, until last week.
Someone (chinese IP address) logged in as root and changed some system settings and logged out.
I restored the system from a backup, and changed the SSH port so that it can't be reached through the ADSL modem anymore to give me some time to solve this problem.
The problem seems to be in
#%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required /lib/security/pam_env.so auth sufficient /lib/security/pam_unix.so likeauth nullok auth required /lib/security/pam_deny.so account required /lib/security/pam_unix.so password required /lib/security/pam_cracklib.so retry=3 password sufficient /lib/security/pam_unix.so nullok use_authtok md5 password required /lib/security/pam_deny.so session required /lib/security/pam_limits.so session required /lib/security/pam_unix.so
When I change
auth sufficient /lib/security/pam_unix.so likeauth nullok
auth sufficient /lib/security/pam_unix.so likeauth
then the root account doesn't accept any random password anymore, but it doesn't accept my configured password either
I tried the following:
- first change the root password via the
passwdcommand. result : i could login with any password
- then remove
nullok: I couldn't login with any password in a new SSH session, not even with the password I just set
- then I changed the root password again. result : I still couldn't login with any password in a new SSH session.
- then I put
nullokback in system-auth : I could login with any password again
All the time I did the editing and password setting in a SSH session which I kept open, and tested the result by opening a new SSH session.
I didn't dare to close my main SSH session in fear that I would not be able to enter again. Also I didn't reboot the system as it's a running system for traffic lights
I was surprised I didn't have to enter an old password, but could just give the new password (2 times).
After changing the password I got the answer
Password changed but I could not login via SSH with the new password.
Do I have to set the root password somewhere else? Or does removing
nullok completely block the root account via SSH?
I want the
root only to be able to login with 1 specific password and deny access for any other password.