1

[ this is a follow-up on my post on ServerFault : https://serverfault.com/questions/661136/root-accepts-any-password-how-to-change-to-a-real-password ]

On an old system the root account accepts any password, as long as it's not empty. Any password was accepted as the correct password, so anyone could login.

In the past (more than 10 years ago) this wasn't a problem as the system was behind a dial-up modem with its own authentication ... but since a few years the system can be reached via a public IP address.

Miraculously noone ever bothered with its SSH port, until last week.

Someone (chinese IP address) logged in as root and changed some system settings and logged out.

I restored the system from a backup, and changed the SSH port so that it can't be reached through the ADSL modem anymore to give me some time to solve this problem.

The problem seems to be in /etc/pam.d/system-auth :

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      /lib/security/pam_env.so
auth        sufficient    /lib/security/pam_unix.so likeauth nullok
auth        required      /lib/security/pam_deny.so

account     required      /lib/security/pam_unix.so

password    required      /lib/security/pam_cracklib.so retry=3
password    sufficient    /lib/security/pam_unix.so nullok use_authtok md5
password    required      /lib/security/pam_deny.so

session     required      /lib/security/pam_limits.so
session     required      /lib/security/pam_unix.so

When I change

auth        sufficient    /lib/security/pam_unix.so likeauth nullok

to

auth        sufficient    /lib/security/pam_unix.so likeauth

then the root account doesn't accept any random password anymore, but it doesn't accept my configured password either

I tried the following:

  • first change the root password via the passwd command. result : i could login with any password
  • then remove nullok : I couldn't login with any password in a new SSH session, not even with the password I just set
  • then I changed the root password again. result : I still couldn't login with any password in a new SSH session.
  • then I put nullok back in system-auth : I could login with any password again

All the time I did the editing and password setting in a SSH session which I kept open, and tested the result by opening a new SSH session.

I didn't dare to close my main SSH session in fear that I would not be able to enter again. Also I didn't reboot the system as it's a running system for traffic lights

I was surprised I didn't have to enter an old password, but could just give the new password (2 times).

After changing the password I got the answer Password changed but I could not login via SSH with the new password.

Do I have to set the root password somewhere else? Or does removing nullok completely block the root account via SSH?

I want the root only to be able to login with 1 specific password and deny access for any other password.

  • What do you mean, Before, and after, changing system-auth I set the root password? Did you change the root password first and could you then login with the new password, and did you then change the pam file and change the password again, or did you first try logging in again? Why do you want to remove the nullok anyway, the problem wasn't that the password was empty but that it was guessed, right? – wurtel Jan 21 '15 at 11:00
  • I edited my question to show what I did chronologically .... whatever I did, either all passwords were accepted, or no password was accepted (at least not the one I just set) – Hrqls Jan 21 '15 at 11:10
  • the problem was that anyone could login into the root account with any password, they didnt have to guess, any password was accepted as the correct password. – Hrqls Jan 21 '15 at 11:13
  • That's not what nullok is for; that enables the use of empty passwords (the configured password needs to be empty, not the given password). Something else must be going on. – wurtel Jan 21 '15 at 11:17
  • Ah ok ... can you explain why any password was accepted when nullok was there, and no password was accepted after I removed nullok ? – Hrqls Jan 21 '15 at 11:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.