I do a lot of local development work with (CentOS/RHEL) virtual machines. Rather than configuring everything with a default root password -- which, if exposed to the network, can be problematic -- I'd like to configure them to allow passwordless root login only on the serial console.
My first attempt was to simply replace the default ExecStart
command for [email protected]
with a command line using the --autologin
option:
ExecStart=-/sbin/agetty -o '-p -- \\u' --keep-baud 115200,38400,9600 --noclear --autologin root ttyS0 $TERM
While this skips the login:
prompt, it still prompts for a root password. This appears to be a limitation of the login
program under Linux.
I also tried replacing the default login program with a shell, like this:
ExecStart=-/sbin/agetty -o '-p -- \\u' --keep-baud 115200,38400,9600 --noclear -n -l /bin/bash ttyS0 $TERM
But this runs afoul of selinux: while I get a bash
shell, it has no access to anything:
bash: /root/.bashrc: Permission denied
# ls /etc/systemd
ls: cannot open directory '/etc/systemd': Permission denied
Elsewhere on the net, people have suggested just removing the password hash from /etc/{password,shadow}
, but of course that results in a different set of problems: now any user can su -
without a password.
Any thoughts on how to make this work properly?