I found many articles mentioning that user has no password after using passwd -d. While on some of my systems it indeed works (I can su from unprivileged accounts to them without giving password) on some systems it doesn't. I tried both * and empty but none of those works:

lapsio@pi-car1:~ $ sudo useradd potato -p '*'
lapsio@pi-car1:~ $ su potato
su: Authentication failure
lapsio@pi-car1:~ $ sudo passwd -d potato
passwd: password expiry information changed.
lapsio@pi-car1:~ $ su potato
su: Authentication failure
lapsio@pi-car1:~ $

Please note that I'm not talking about empty password (which can be set with empty string hash). I'm not talking about locking account either. I'm expecting situation where no Password: prompt appears at all in su and getty and I am able to log into that account instantly without being asked for password at all. It seems to work on older systems. Is there some system level configuration that controls this behavior?

To make it super clear I'm expecting following behavior:

lapsio@pi-car1:~ $ su potato
potato@pi-car1:~ $ #I'm potato user here, without being asked for password

Kind of like it works when you su from root except i want to be able to su from any unprivileged account as well. And log in from getty without seing password prompt, just like when you log in to root account on Arch liveCD for example.

Yes I am aware that it's terrible security practice and I'm aware of consequences of such practice but I still want to know how to do that.

1 Answer 1


The PAM configuration for su is typically located at /etc/pam.d/su and it may refer to other files in the same directory using the @include directive. At some point, there will be a line that begins with auth and mentions pam_unix.so. In older distributions, it might include a nullok option that allows empty passwords; modern distributions usually use nullok_secure, which allows empty passwords only when the "authentication" is happening using one of the TTY devices listed in /etc/securetty. Also, the implementation of the nullok option may vary.

In order to allow su to definitely allow access to a specific account without a password prompt, you might add a line like this:

auth sufficient pam_succeed_if.so quiet_fail user = potato

(note: spaces between user, = and potato are important!)

In order to take effect before pam_unix.so, and with the su command only, the line should be placed in /etc/pam.d/su before any @include directives or other lines starting with auth.

However, creating a shortcut through su's PAM configuration like this is a bit risky without first understanding how the PAM configuration is supposed to work in your unspecified Linux distribution. Test carefully before use.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .