Create a new account called test:

$ sudo useradd test

test doesn't have a password right now. So

$ su test

doesn't work. If you try, you're asked for test's password. It doesn't have one. That's not the same as its password being empty so if you enter an empty password by pressing enter, you get message "su: Authentication failure".

The same is true if you switch to a tty and try to log in as test: An empty password isn't accepted.

Now assign test an empty password:

$ sudo passwd -d test

You can now log in as test on a tty by providing the empty string as the password. However, if you try

$ su test

again, you still get the message "su: Authentication failure" the session doesn't switch to the user test.

Why is this?

  • Whats the output of ldd /bin/su | grep -q pam && echo OK? – heemayl Oct 15 '16 at 23:23
  • For me after sudo passwd -d test I was able to su - test without a password using a non-root account. Which distribution are you using? – Thomas Oct 16 '16 at 8:59
  • @heemayl The output is simply "OK". – UTF-8 Oct 16 '16 at 12:47
  • @Thomas I don't really see the point of a single dash between "su" and "test". Did you maybe want to put 2 dashes there? Anyways, it doesn't work for me either way. I'm using Ubuntu 16.04. – UTF-8 Oct 16 '16 at 12:48
  • su - starts a login shell. For more details look up the manpage of su. – Thomas Oct 16 '16 at 15:41

From the output of ldd /bin/su, the su binary is compiled with the pam libraries (libpam*), so the authentication, account management, session initiation etc stuffs will be managed by pam.

The following is how a typical Ubuntu system's su is managed by pam, you should find similar approach if you are using another distro.

The pam rules for su are defined in the file /etc/pam.d/su. This file also includes the common-auth, common-passwd, common-session files from same directory as common templates for covering the tasks their name suggest (and used in other pam enabled services).

On my system, at the bottom of /etc/pam.d/su i have:

@include common-auth
@include common-account
@include common-session

The preceding lines do not deal with the null password checking, it is mainly the job of pam_unix module.

Now /etc/pam.d/common-auth has:

auth    [success=1 default=ignore]      pam_unix.so nullok_secure

From man pam_unix:


The default action of this module is to not permit the user access to a service if their official password is blank. The nullok argument overrides this default and allows any user with a blank password to access the service.


The default action of this module is to not permit the user access to a service if their official password is blank. The nullok_secure argument overrides this default and allows any user with a blank password to access the service as long as the value of PAM_TTY is set to one of the values found in /etc/securetty.

as you can see if the nullok_secure option is set, the unless the environment variable PAM_TTY is set in the mentioned manner, the user with null password will not be permitted to login using su.

So to allow any user with null password to do su, you need to have the nullok argument to the pam_unix module:

auth    [success=1 default=ignore]      pam_unix.so nullok

this is insecure as the common-auth file is used by many other services, even for only su this should not be done. (For the sake of testing you can set it once and then revert back to original. Although if you want to do the test, it's better to incorporate all the logics in /etc/pam.d/su file, and amend any changes afterwards rather than messing with any common-* file)


From man useradd:

-p, --password PASSWORD 
The encrypted password, as returned by crypt(3). The default is to disable the password.
Note: This option is not recommended because the password (or encrypted password) will be visible by users listing the processes. 

You didn't use --password, so the userid was given a special, "disabled" password. Not the same as an empty password.

It would be a Security Hole the other way.

  • This is not what he is asking. He did manage to correctly set the user password to empty, but still cannot log in from su, although he can log in from the tty – IW16 Oct 16 '16 at 5:24
  • Thank you, @IW16. I set the password to the empty string using the command sudo passwd -d test so there is this intermediate step where neither login via su nor via tty works so people know that I know the difference between the password being the empty string and the password not being set. – UTF-8 Oct 16 '16 at 12:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.