On Tue, 27 Jan 2009 23:34:27 +0100 Guenther Fuchs <vserver@muh.at> wrote: > on Tuesday, January 27, 2009 at 7:12:43 PM there was posted: > > JASI> Thanks. I am assuming not setting the password only disables > JASI> use of login for root and processes will still be able to use > JASI> it. Please let me know if that is an invalid assumption - John > > It as well disables use of "su" - and yes, you're right. if its a system that uses pam (pluggable authentication modules) extensively (as debian and ubuntu do), then the answer is a little bit more complex. as long as "pam_unix.so" is "required" or "requisite" for "auth" and "nullok" and "nullok_secure" options are absent, then a null root password in passwd/shadow guarantees that no one will be authenticated as root. but the default for debian and ubuntu is to include "common-auth" in many application-specific pam config files, which it contains "auth requisite pam_unix.so nullok_secure". nullok_secure: "The default action of this module is to not permit the user access to a service if their official password is blank. The nullok_secure argument overrides this default and allows any user with a blank password to access the service as long as the value of PAM_TTY is set to one of the values found in /etc/securetty." but /etc/securetty by default only lists physical interfaces (eg ttyS0, tty1, ttyUSB0), so the default depends on physical security. so, as i said, the answer to any authentication question is a bit complex (and though ssh doesn't have to use pam, its own config file options are complex by themselves). but that complexity allows me to do some interesting things like only allowing root to log in using passwords at a physical console or using one-time-passwords otherwise (generated by my pda), so i don't have to worry about keyloggers, shoulder-surfing, keyboard wear patterns, or typing speed analysis. ;-) corey -- undefined@pobox.com