Why do some people think linux machine accounts with passwords are more secure than accounts without passwords?

Question

It seems to be a recurring theme that some people are dead set to add passwords to password less system accounts on Linux "because its more secure". I currently have regular discussions with customers about this. They themselves do not understand much about IT, however they have security experts scanning their systems and then have the finding that "that account does not have a password".

To my understanding, the contrary is the case. An account that does not have a password has one option less to authenticate. Or viewed differently, if there is no password, it cannot be brute forced. Do I miss anything? Is there any security benefit in adding a password to an account that technically does not need a password?

Answer 1

It really depends on what you call password less accounts. An account with an empty password in the password database (normally /etc/shadow) is highly unsecure because anybody could use it. On the other hand, an impossible to match password like * in same database prevents anybody to log with this account because no password could ever give such a hash. In the latter case, adding a password is just useless and actually lowers the account security because it could be brute forced.

Answer 2

Your understanding is correct.

In my view there is no security benefit to not having a password when you have the option to have a password. Having a layer of authentication for a user is almost always going to be more secure than not having it. Even if /etc/shadow is exposed an attacker will still need to discover and retrieve/brute force the password from it.

There may be situations where you do want an account to not have a password, perhaps some service account or something, but this has nothing to do with making the account more secure and everything to do with practicality, convenience and/or functionality.

UPDATE: Just to add that adding a password when there isn’t one already as described by Serge Ballesta is of course going to introduce something that can be attacked.

Answer 3

The only time I've seen this confusion come up is in a large organization where InfoSec mandated the use of particular security hardening tools. The tools would sometimes have specific requirements on password strength and rotation, or they have requirements to have password authentication on sudo.

This leads to the awkward discussion of "no password" and the endless confusion from management. To be clear, I try to say "password authentication is not possible".

Rather than obtaining a security exemption from password requirements, or explaining it to an auditor, it becomes necessary to enable password authentication and create passwords.

This is generally less secure, introduces issues around lockouts and expiration affecting the more secure methods of access.

If you check your company's InfoSec policies and the standards they need to comply with, it might explain the policy.