3

Having read this: https://stackoverflow.com/questions/11700690/how-do-i-completely-remove-root-password I was under the impression that a blank root password, as in modifying the /etc/shadow file for the root entry to be something like this:

root::0:0:99999:7:::

Should allow me to su to root without being prompted for a password.

Please note that I'm not looking for a practical or secure way to do this. I'm aware that public key authentication is a viable way to do this in a sane way through authorized_keys and SSH. That's not what this question is concerned with.

The expected behavior is that either not prompting for a password or at least accept a blank password when prompted (enter key, nothing more) should allow the user to become root.

Actual behavior is that the user does get prompted for a password, and does not accept a blank password (enter key). I also tried su -, su root, su - root. Same behavior. Just to be certain that I actually did change the shadow file I also tried my old password, which also doesn't work, although simply a cat of the shadow file should be enough to confirm that this change was actually carried out. Restoring the original shadow file from my shadow.bak restored original functionality.

This is on a Debian 9 system, su from util-linux 2.32.1.

Is my syntax incorrect? Should it be root::0:0:99999:7::: or is this ability to use a blank password no longer possible? Since when was it removed?

  • 2
    console login with root works. – Rui F Ribeiro Oct 8 '18 at 15:50
  • I see, thanks. Has su into root with a blank password ever worked? – AlphaCentauri Oct 8 '18 at 15:51
  • I could swear it did not work, cannot remember it properly. – Rui F Ribeiro Oct 8 '18 at 15:52
2

Since su is usually configured via pam_unix, it's oftentimes configured with the nullok_secure directive on Debian systems:

$ grep -m1 pam_unix /etc/pam.d/system-auth
auth        sufficient     pam_unix.so nullok_secure

Changing that default to just nullok should enable password-less su usage.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.