Let's say somebody sitting under user (non-admin, not root), but he didn't set up any password for it, only superuser/root has password. Is it bad practice (in context of remote access to a desktop through Internet) ?

  • I think you need to provide more context ... network setup, software, services ... – pLumo May 16 '19 at 8:30
  • @RoVo I'm talking about remote access through Internet to a desktop. – R S May 16 '19 at 8:37
  • and the desktop is behind a router ? what about software or services? – pLumo May 16 '19 at 9:03
  • @RoVo I think it's important to know for desktop with and without router. Software or services - nothing special, just some average desktop, whatever usual people could use: browser, messenger, email client may be... – R S May 16 '19 at 12:18

As you point out the user may not be able to do any permanent damage to the system without admin rights but there is a lot they can do which you'd prefer they didn't.

Zombie machines get used for carrying out DDOS attacks and sending spam or as proxies for carrying out further attacks. It's a particular problem with IoT devices at the moment. Those responsible for these attacks actively search the internet for machines they can login to. You might think that an obscure username is enough but that's generally not true. Attackers will try very very long lists of usernames with blank passwords.

If you have any remote login to the system accessible from the internet (eg SSH or just email SMTP) then this user will be breached. There are countless bots on the internet poking every single internet IPv4 address.

For reference I receive around 500 pokes per day. I've seen reports of others recieving 10,000 or even 100,000

So if you allow passwordless login on anything but a reasonably firewalled laptop with no external access you can pretty much guarantee it will be logged into and used for a further attack.

| improve this answer | |
  • I would argue that for SSH empty password is even more secure unless you explicitly set PermitEmptyPasswords yes which should not be the default anywhere. – pLumo May 16 '19 at 8:31
  • @RoVo Blank passwords on unlocked accounts are a bad idea period. If you want to lock an account then ... lock the account. It's bad advice to suggest an account can be locked by blanking the password. The major risk is that other (future?) services might not impose the same rule. For the specific case of SSH, PasswordAuthentication no is preferable to simply relying on PermitEmptyPasswords no because if someone tries to blank their password and then finds they cannot log in, their next step is to reset their password to 12345678. – Philip Couling May 16 '19 at 9:16
  • I didn't say your conclusion is wrong, but lacking references. Just claiming that it is a bad idea is imho not enough. – pLumo May 16 '19 at 9:24
  • Imo, your main argument about people searching "[...]machines they can login to" is not valid, as empty password doesn't anyone allow to remotely login to your machine. See my first comment. – pLumo May 16 '19 at 9:30
  • 2
    I see around 10 IPs per month on my "obscure" SMTP server trying just that, including my very first IPv6 attack. Meaning they've discovered the "obscure" DNS subdomain and then started blasting it with usernames bob, backup, wordpres... Very many error log entries report blank password as the point of failure. fail2ban is there for a reason. – Philip Couling May 16 '19 at 9:40

Yes it is bad practice because using an empty password probably is one of the first attempts of someone trying to hack into a system.
Provided the system is accessible from the outside.

Once an intruder has access to the system they can do whatever the user can do.
This is disturbing enough to take care to prevent that, even if this intruder is "only" running with user's permissions instead of root.

| improve this answer | |
  • Please provide some more information on the why and how. "I strongly guess" is not a good base for an answer. – pLumo May 16 '19 at 8:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.