From the output of
ldd /bin/su, the
su binary is compiled with the
pam libraries (
libpam*), so the authentication, account management, session initiation etc stuffs will be managed by
The following is how a typical Ubuntu system's
su is managed by
pam, you should find similar approach if you are using another distro.
pam rules for
su are defined in the file
/etc/pam.d/su. This file also includes the
common-session files from same directory as common templates for covering the tasks their name suggest (and used in other
pam enabled services).
On my system, at the bottom of
/etc/pam.d/su i have:
The preceding lines do not deal with the null password checking, it is mainly the job of
auth [success=1 default=ignore] pam_unix.so nullok_secure
The default action of this module is to not permit the user access to a service if their official password is blank. The nullok argument overrides this default and allows any user with a
blank password to access the service.
The default action of this module is to not permit the user access to a service if their official password is blank. The nullok_secure argument overrides this default and allows any user
with a blank password to access the service as long as the value of PAM_TTY is set to one of the values found in /etc/securetty.
as you can see if the
nullok_secure option is set, the unless the environment variable
PAM_TTY is set in the mentioned manner, the user with null password will not be permitted to login using
So to allow any user with null password to do
su, you need to have the
nullok argument to the
auth [success=1 default=ignore] pam_unix.so nullok
this is insecure as the
common-auth file is used by many other services, even for only
su this should not be done. (For the sake of testing you can set it once and then revert back to original. Although if you want to do the test, it's better to incorporate all the logics in
/etc/pam.d/su file, and amend any changes afterwards rather than messing with any