98

I'm trying to create a user without password like this:

sudo adduser \
   --system \
   --shell /bin/bash \
   --gecos ‘User for managing of git version control’ \
   --group \
   --disabled-password \
   --home /home/git \
   git

It's created fine. But when I try to login under the git user I'm getting the password entering:

su git
Password:...

When I leave it empty I get an error:

su: Authentication failed

What's wrong?

8
  • 1
    Nothing is wrong, the authentication failed as expected. You won't get a "there is no password, you can't login" error message.
    – scai
    Nov 26, 2012 at 13:43
  • But I need to create .ssh folder under the git user, how should I do that?
    – Erik
    Nov 26, 2012 at 13:46
  • 2
    Either create it as root and set the correct permissions, or execute su git as root where you don't have to provide a password.
    – scai
    Nov 26, 2012 at 13:46
  • 4
    By using chmod and chown.
    – scai
    Nov 26, 2012 at 13:52
  • 2
    I just wanted to point out that letting the git user have Bash as a shell is a bad idea, security wise. That would allow users of this repo to get a shell in your server. If you set the shell to /usr/bin/git-shell you can limit their account to using git and nothing else. (You should also limit SFTP access but that can only be done from /etc/sshd_config). Now, once you changed the shell, "su" won't work as-is. You'll have to do "su -s /bin/sh git" instead.
    – MarioVilas
    Mar 3, 2020 at 16:17

7 Answers 7

72

The --disabled-password option will not set a password, meaning no password is legal, but login is still possible (for example with SSH RSA keys).

To create an user without a password, use passwd -d $username after the user is created to make the password empty. Note not all systems allow users with empty password to log in.

2
46

You've created a user with a “disabled password”, meaning that there is no password that will let you log in as this user. This is different from creating a user that anyone can log in as without supplying a password, which is achieved by specifying an empty password and is very rarely useful.

In order to execute commands as such “system” users who don't log in normally, you need to hop via the root account:

su -c 'su git -c "git init"'

or

sudo -u git git init

If you want certain users to be able to run commands as the git user without letting them run commands as root, set up sudo (run visudo as root and add a line like %gitters ALL = (git) ALL).

8
  • Another one: sudo su - git git init
    – pylover
    Dec 7, 2019 at 7:51
  • Ubuntu 19.10 seems like does not have --disabled-password parameter, could there be any alternative solution
    – alper
    Jul 7, 2020 at 19:15
  • @alper This has nothing to do with my answer. But anyway, yes, it does. Jul 7, 2020 at 19:40
  • 1
    @alper Write the full path: sudo -u git cat /wherever/main.py. Or add a cd command: sudo -u git sh -c 'cd /wherever && cat main.py'. If you want to be sure that the other user doesn't get access to the current directory even if the command doesn't do what was intended, change directories outside: (cd /wherever && sudo -u git cat main.py) Jul 7, 2020 at 20:02
  • 1
    @alper You didn't use the commands I posted. You used one of many variants (too many for me to guess the exact one) that would result in this particular error. You need to invoke a shell for cd and &&. Jul 7, 2020 at 21:20
11

If you want to access the system under the git user you should use sudo:

sudo -s -u git

or

sudo su - git
9

Create an user with empty password

sudo useradd test-user-0
echo test-user-0:U6aMy0wojraho | sudo chpasswd -e
su test-user-0

The password prompt still shows unfortunately.

But if you just hit enter without typing anything, and it logins as the user test-user-0.

The -e flags tells chpasswd that the password is already encrypted, and U6aMy0wojraho is the hash of the empty string.

Tested on Ubuntu 18.04.

Terminal autologin with getty -a

On the terminal at least, you don't need to create an user without a password to allow someone to not type their passwords every time.

I was able to do this on BusyBox by modifying inittab: How to login automatically without typing the root username or password in Buildroot BusyBox init?

So I believe that it should not be very hard to adapt that technique by modifying Ubuntu 18.04's systemd init system scripts to setup a getty -a <user> terminal as mentioned in that answer, although I haven't tried to do it myself.

7

I think this is what you want:

adduser --disabled-password --shell /bin/bash --gecos "User" $username

You'll be able to

su $username

to run commands as that user, in /bin/bash or whatever shell you specify. --gecos "User" just put "User" into the comment field so you aren't prompted for that information. You can put whatever you want into that field.

0
0

Once you created a user with this command-line option --disabled-password follow below instructions as root user

sudo visudo

Add below line at EOF.

<username> ALL=(ALL) NOPASSWD:ALL

Save visudo file. Now try to execute sudo commands with newly created user. It should work.

0

For some versions of adduser there is a -p option for supplying the encrypted password, however if an empty string is supplied it is the same has setting no password: adduser -p '' mypasswordlessuser

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.