Subject: Re: [vserver] Guest root passwords
From: Corey Wright <undefined@pobox.com>
Date: Wed, 28 Jan 2009 00:16:03 -0600

On Tue, 27 Jan 2009 23:34:27 +0100
Guenther Fuchs <vserver@muh.at> wrote:

> on Tuesday, January 27, 2009 at 7:12:43 PM there was posted:
> 
> JASI> Thanks.  I am assuming not setting the password only disables
> JASI> use of login for root and processes will still be able to use
> JASI> it.  Please let me know if that is an invalid assumption - John
> 
> It as well disables use of "su" - and yes, you're right.

if its a system that uses pam (pluggable authentication modules)
extensively (as debian and ubuntu do), then the answer is a little bit more
complex.

as long as "pam_unix.so" is "required" or "requisite" for "auth" and
"nullok" and "nullok_secure" options are absent, then a null root password
in passwd/shadow guarantees that no one will be authenticated as root.  but
the default for debian and ubuntu is to include "common-auth" in many
application-specific pam config files, which it contains "auth requisite
pam_unix.so nullok_secure".

nullok_secure: "The default action of this module is to not permit the user
access to a service if their official password is blank. The nullok_secure
argument overrides this default and allows any user with a blank password
to access the service as long as the value of PAM_TTY is set to one of the
values found in /etc/securetty."

but /etc/securetty by default only lists physical interfaces (eg ttyS0,
tty1, ttyUSB0), so the default depends on physical security.

so, as i said, the answer to any authentication question is a bit complex
(and though ssh doesn't have to use pam, its own config file options are
complex by themselves).  but that complexity allows me to do some
interesting things like only allowing root to log in using passwords at a
physical console or using one-time-passwords otherwise (generated by my
pda), so i don't have to worry about keyloggers, shoulder-surfing, keyboard
wear patterns, or typing speed analysis. ;-)

corey
-- 
undefined@pobox.com