Freebsd – Any random password results in successful login on tty

freebsdpasswordrootSecurity

I can login to my machine (FreeBSD 9.1-RELEASE) for any user (for example: root or operator or any that exists in /etc/passwd) with any random password that I type…

I tried to reset password for root with passwd, but again if I try to login I can login with any random password that I type in… strange.

This ONLY works when I login directly from tty. When trying to log in via SSH, everything is as it should be – I need to give correct password to log in. How to fix this?

EDIT: Contents of /etc/ttys:

# name  getty                           type    status          comments
#
# If console is marked "insecure", then init will ask for the root password
# when going to single-user mode.
console none                            unknown off secure
#

console none                            unknown off secure
#
ttyv0   "/usr/libexec/getty Pc"         xterm   on  secure
# Virtual terminals
ttyv1   "/usr/libexec/getty Pc"         xterm   on  secure
ttyv2   "/usr/libexec/getty Pc"         xterm   on  secure
ttyv3   "/usr/libexec/getty Pc"         xterm   on  secure
ttyv4   "/usr/libexec/getty Pc"         xterm   on  secure
ttyv5   "/usr/libexec/getty Pc"         xterm   on  secure
ttyv6   "/usr/libexec/getty Pc"         xterm   on  secure
ttyv7   "/usr/libexec/getty Pc"         xterm   on  secure
ttyv8   "/usr/local/bin/xdm -nodaemon"  xterm   off secure
# Serial terminals
# The 'dialup' keyword identifies dialin lines to login, fingerd etc.
ttyu0   "/usr/libexec/getty std.9600"   dialup  off secure
ttyu1   "/usr/libexec/getty std.9600"   dialup  off secure
ttyu2   "/usr/libexec/getty std.9600"   dialup  off secure
ttyu3   "/usr/libexec/getty std.9600"   dialup  off secure
# Dumb console
dcons   "/usr/libexec/getty std.9600"   vt100   off secure

Best Answer

Edit /etc/ttys so that the line:

console none                            unknown off secure

is replaced with:

console none                            unknown off insecure

Also, you should have only one console line in your config.

Related Question