Solaris/OpenIndiana: Password for roles?

Question

I've been gently experimenting with roles in Solaris, and wonder a bit about setting a password for it.

I want the role I've created to be used by several users, so setting password to the same as one user (as is done for the root-role) is not an option. Having several users "sharing" (knowing) a single password, I've heard is a bad idea - that is after all the rational behind sudo.

So for now, I've set a blank password (just "Enter"). I did this not by leaving the field in /etc/shadow blank nor by setting it to "NP"... I did it by using passwd to set it to nothing (pressed "Enter" twice) - and the resulting encrypted entry was surprisingly long and garbeled.

So my first question; is it safe to leave a role with blank ("Enter") as password? After all, only logged-in users with that role can assume it...

A few more questions:

Is there some way in the role-specification to specify that a user should authenticate with his own password - rather than the role's - to switch to the role (without changing the role's password to that of the user, as I assume is done with the root-role)? If not, are there other ways (eg. by using sudo - maybe in combination with su? If so, how?) to accomplish this?

How is the root-role bound to the password of the "first user"? Is it some field in the role-specification that makes it happen automatically? What happens behind the scenes to make it happen?

Answer 1

Yes, it is safe to remove the password from a role. In fact at my site we do it more or less by default (except for the root role).

As you point out a user that assumes a role has already been authenticated so asking him to authenticate once again is really just too much authentication IMHO.

I believe this also answers your second question. Just remove password from the role!

A few notes on how to remove a password from a role. In the following that role is named roleX.

In Solaris 10

It has always been enough for me simply to do:

passwd -r files -d roleX

In Solaris 11

Something has been changed by Sun/Oracle wrt enforcement of the PASSREQ parameter in /etc/default/login (see man page for login). In order to create a role without a password you need to do as in Solaris 10 on each role account as well as globally setting the PASSREQ parameter to 'NO' in /etc/default/login.

As I see it PASSREQ acts as a last line of defense. You still need to physically remove the password from each account in order for the account not to have a password. I wish Solaris had a setting like PASSREQROLE (my proposal) that would say if it was ok for role accounts not to have a password (rather than for all accounts as is the interpretation of PASSREQ).