Allow passwordless root login on the serial console

Question

I do a lot of local development work with (CentOS/RHEL) virtual machines. Rather than configuring everything with a default root password -- which, if exposed to the network, can be problematic -- I'd like to configure them to allow passwordless root login only on the serial console.

My first attempt was to simply replace the default ExecStart command for [email protected] with a command line using the --autologin option:

ExecStart=-/sbin/agetty -o '-p -- \\u' --keep-baud 115200,38400,9600 --noclear --autologin root ttyS0 $TERM

While this skips the login: prompt, it still prompts for a root password. This appears to be a limitation of the login program under Linux.

I also tried replacing the default login program with a shell, like this:

ExecStart=-/sbin/agetty -o '-p -- \\u' --keep-baud 115200,38400,9600 --noclear -n -l /bin/bash ttyS0 $TERM

But this runs afoul of selinux: while I get a bash shell, it has no access to anything:

bash: /root/.bashrc: Permission denied
# ls /etc/systemd
ls: cannot open directory '/etc/systemd': Permission denied

Elsewhere on the net, people have suggested just removing the password hash from /etc/{password,shadow}, but of course that results in a different set of problems: now any user can su - without a password.

Any thoughts on how to make this work properly?

Answer 1

After some experimenting, I've got something that works:

1. Run systemctl edit [email protected], and add the following:

   [Service]
   ExecStart=
   ExecStart=-/sbin/agetty -o '-p -- \\u' --keep-baud 115200,38400,9600 --noclear --autologin root ttyS0 $TERM
   

   This will cause agetty to auto-login the root user, but with only this change the system will still prompt you for the root password.

2. We can configure /etc/pam.d/login to authenticate root logins on the console without a password. Add the following to the top of /etc/pam.d/login:

   auth sufficient pam_listfile.so item=tty sense=allow file=/etc/securetty onerr=fail apply=root
   

   This will cause the PAM stack to check for the login tty in /etc/securetty, and to skip other authentication mechanisms if it finds it.

3. Add the serial port to /etc/securetty:

   # echo ttyS0 > /etc/securetty
   

With these changes in place, you'll see the following on the serial console when you boot:

CentOS Linux 8 (Core)
Kernel 4.18.0-80.11.2.el8_0.x86_64 on an x86_64

localhost login: root (automatic login)

Last login: Sun Nov 17 00:29:36 on ttyS0
[root@localhost ~]#

...and if you log out, you'll end up right back at the shell prompt.

Note that I've used the filename /etc/securetty here, which in days of yore actually did something else (it controlled terminals on which root was allowed to log in). So if that bothers you, use a different file :).