I've been gently experimenting with roles in Solaris, and wonder a bit about setting a password for it.

I want the role I've created to be used by several users, so setting password to the same as one user (as is done for the root-role) is not an option. Having several users "sharing" (knowing) a single password, I've heard is a bad idea - that is after all the rational behind sudo.

So for now, I've set a blank password (just "Enter"). I did this not by leaving the field in /etc/shadow blank nor by setting it to "NP"... I did it by using passwd to set it to nothing (pressed "Enter" twice) - and the resulting encrypted entry was surprisingly long and garbeled.

So my first question; is it safe to leave a role with blank ("Enter") as password? After all, only logged-in users with that role can assume it...

A few more questions:

Is there some way in the role-specification to specify that a user should authenticate with his own password - rather than the role's - to switch to the role (without changing the role's password to that of the user, as I assume is done with the root-role)? If not, are there other ways (eg. by using sudo - maybe in combination with su? If so, how?) to accomplish this?

How is the root-role bound to the password of the "first user"? Is it some field in the role-specification that makes it happen automatically? What happens behind the scenes to make it happen?


Yes, it is safe to remove the password from a role. In fact at my site we do it more or less by default (except for the root role).

As you point out a user that assumes a role has already been authenticated so asking him to authenticate once again is really just too much authentication IMHO.

I believe this also answers your second question. Just remove password from the role!

A few notes on how to remove a password from a role. In the following that role is named roleX.

In Solaris 10

It has always been enough for me simply to do:

passwd -r files -d roleX

In Solaris 11

Something has been changed by Sun/Oracle wrt enforcement of the PASSREQ parameter in /etc/default/login (see man page for login). In order to create a role without a password you need to do as in Solaris 10 on each role account as well as globally setting the PASSREQ parameter to 'NO' in /etc/default/login.

As I see it PASSREQ acts as a last line of defense. You still need to physically remove the password from each account in order for the account not to have a password. I wish Solaris had a setting like PASSREQROLE (my proposal) that would say if it was ok for role accounts not to have a password (rather than for all accounts as is the interpretation of PASSREQ).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.