5

Why can root's password can be changed without entering the old password? Is there any benefit to this or is it just an implementation fault? If we issue passwd from a normal user account it first asks for " (Current) Unix Password: " but in the case of root it takes us directly to " Enter new Unix password: ". I don't understand the logic behind this.

Improve this question
2
  • 3
    One reason is that significantly often, you have a root shell but don't know the password, and need to change it. Since root has write access to /etc/shadow anyway, having the passwd tool require the old password wouldn't give any extra security.
    – Tom Hunt
    Oct 27, 2015 at 15:36
  • 2
    Another reason is that root can directly edit /etc/shadow so there's no point in requiring root to enter the old password when running passwd, even when changing root's own password. root can just generate a crypted or md5 password by some other means and edit it directly into /etc/shadow.
    – cas
    Oct 27, 2015 at 22:40

3 Answers 3

Reset to default
6

Root owns and can write to both /etc/passwd and /etc/shadow anyway. Which does not mean the sysadmin SHOULD know her user's passwords. In fact, she should not know anything else than the root password.

Improve this answer
0

The purpose of

  • asking user, old password before changing

You may have left you keyboard/connection connected with you session open. I might want to change your password. As a (little) security check, old password is asked, so system know rightfull user change password.

  • root not being asked for other user password

You might have forger your password, a human being with admin right change it back to you. Root can edit /etc/passwd /etc/shadow, so to avoid messing up those files, root can change without check.

Improve this answer
-2

Root may change any users password without entering the old value.

This is because the root user cannot know the old password for other users.

Not asking for the old password for root as well is orthogonal behavior.

Improve this answer
4
  • Okay. i don't think the same case with its own password, it can be a security flaw? Isn't it?
    – user137124
    Oct 27, 2015 at 15:38
  • No, it is just uniform behavior and root could do the change even without using the program passwd.
    – schily
    Oct 27, 2015 at 15:43
  • 2
    The question asks why -- this answer basically only repeats the same statement posed in the question, without any explanation of the reasoning involved.
    – Chris Down
    Oct 27, 2015 at 16:05
  • Well, wid didn't you ask the other people who replied without explaining the background? The fact that root may change any password is documented in the man page. I added an obvious reason to my answer.
    – schily
    Oct 27, 2015 at 16:20

You must log in to answer this question.