Why can't `su` be used to switch to users with empty password?

Question

Create a new account called test:

$ sudo useradd test

test doesn't have a password right now. So

$ su test

doesn't work. If you try, you're asked for test's password. It doesn't have one. That's not the same as its password being empty so if you enter an empty password by pressing enter, you get message "su: Authentication failure".

The same is true if you switch to a tty and try to log in as test: An empty password isn't accepted.

Now assign test an empty password:

$ sudo passwd -d test

You can now log in as test on a tty by providing the empty string as the password. However, if you try

$ su test

again, you still get the message "su: Authentication failure" the session doesn't switch to the user test.

Why is this?

Answer 1

From the output of ldd /bin/su, the su binary is compiled with the pam libraries (libpam*), so the authentication, account management, session initiation etc stuffs will be managed by pam.

The following is how a typical Ubuntu system's su is managed by pam, you should find similar approach if you are using another distro.

The pam rules for su are defined in the file /etc/pam.d/su. This file also includes the common-auth, common-passwd, common-session files from same directory as common templates for covering the tasks their name suggest (and used in other pam enabled services).

On my system, at the bottom of /etc/pam.d/su i have:

@include common-auth
@include common-account
@include common-session

The preceding lines do not deal with the null password checking, it is mainly the job of pam_unix module.

Now /etc/pam.d/common-auth has:

auth    [success=1 default=ignore]      pam_unix.so nullok_secure

From man pam_unix:

nullok

The default action of this module is to not permit the user access to a service if their official password is blank. The nullok argument overrides this default and allows any user with a blank password to access the service.

nullok_secure

The default action of this module is to not permit the user access to a service if their official password is blank. The nullok_secure argument overrides this default and allows any user with a blank password to access the service as long as the value of PAM_TTY is set to one of the values found in /etc/securetty.

as you can see if the nullok_secure option is set, the unless the environment variable PAM_TTY is set in the mentioned manner, the user with null password will not be permitted to login using su.

So to allow any user with null password to do su, you need to have the nullok argument to the pam_unix module:

auth    [success=1 default=ignore]      pam_unix.so nullok

this is insecure as the common-auth file is used by many other services, even for only su this should not be done. (For the sake of testing you can set it once and then revert back to original. Although if you want to do the test, it's better to incorporate all the logics in /etc/pam.d/su file, and amend any changes afterwards rather than messing with any common-* file)

Answer 2

From man useradd:

-p, --password PASSWORD 
The encrypted password, as returned by crypt(3). The default is to disable the password.
Note: This option is not recommended because the password (or encrypted password) will be visible by users listing the processes. 

You didn't use --password, so the userid was given a special, "disabled" password. Not the same as an empty password.

It would be a Security Hole the other way.