Ubuntu – Allow root access without passwd

passwdpasswordrootsettings

Have a VirtualBox Ubuntu guest (14.04) used for the sake of testing only.
The root user has its own password, so I can login as root in a separate terminal (su -), or directly from a login session (eg after Ctrl-Alt-F4).

$ su -
Password: <current root password>
# echo Works!

Since it is a VB testing system, and the root user does not need any security, I want to be able to su - or login as root quickly, i.e. without root having a password.

So, tried as root

# passwd -d root

to remove the root password – it seems to work according to /etc/shadow (::)

root::16304:0:99999:7:::

but when trying to su -, it asks for a password, I just press enter (no password)

$ su -
Password: 
su: Authentication failure

but it doesn't su.

There has to be a setting somewhere to allow root to login/su without password.
Where would that be?

Best Answer

Warning; not tested because I think it's not such a great idea, even for a VM (bad habits are difficult to remove...).

I think this is a PAM thing (PAM=pluggable authentication modules).

In /etc/pam.d there are all the PAM configuration files that tell the system how to do the authentication of users. Now, the module that check for the passwords "unix style" is pam_unix.so, in which man page you can find among the options:

  nullok
       The default action of this module is to not permit the user access
       to a service if their official password is blank. The nullok
       argument overrides this default and allows any user with a blank
       password to access the service.

   nullok_secure
       The default action of this module is to not permit the user access
       to a service if their official password is blank. The nullok_secure
       argument overrides this default and allows any user with a blank
       password to access the service as long as the value of PAM_TTY is
       set to one of the values found in /etc/securetty.

So I suspect is a matter of finding all the occurences of pam_unix.so in the files above, and add the option nullok (or change the nullok_secure to nullok) to the entries.

According to this post the file should be /etc/pam.d/common-auth --- but I am not sure about this because in Ubuntu the VC are in the /etc/securetty list so the null password for root should work from there (although not from a terminal emulator), and the SO states it doesn't work.

So a bit of experimentation will be needed ;-).

Related Question