6

It seems to be a recurring theme that some people are dead set to add passwords to password less system accounts on Linux "because its more secure". I currently have regular discussions with customers about this. They themselves do not understand much about IT, however they have security experts scanning their systems and then have the finding that "that account does not have a password".

To my understanding, the contrary is the case. An account that does not have a password has one option less to authenticate. Or viewed differently, if there is no password, it cannot be brute forced. Do I miss anything? Is there any security benefit in adding a password to an account that technically does not need a password?

  • 8
    People don't realize that "account without a password" is different from "account with empty password." An account with an empty password is utterly insecure. A passwordless account means no password will ever be valid. – ThoriumBR Jul 31 '17 at 13:35
  • That is my suspicion. However, I would have expected "experts" to know the difference ... – Isaac Jul 31 '17 at 14:01
  • 3
    I think you should clarify the question more. The phrase "without a password", isn't very specific and is IMO ambiguous. It can easily mean "doesn't require a password" rather than "can't be logged into". This is in fact what my first thought was when reading the question. In fact, when referring to these accounts, you should call them "non-login accounts" rather than passwordless accounts. – Steve Sether Aug 1 '17 at 17:30
9

It really depends on what you call password less accounts. An account with an empty password in the password database (normally /etc/shadow) is highly unsecure because anybody could use it. On the other hand, an impossible to match password like * in same database prevents anybody to log with this account because no password could ever give such a hash. In the latter case, adding a password is just useless and actually lowers the account security because it could be brute forced.

4

Your understanding is correct.

In my view there is no security benefit to not having a password when you have the option to have a password. Having a layer of authentication for a user is almost always going to be more secure than not having it. Even if /etc/shadow is exposed an attacker will still need to discover and retrieve/brute force the password from it.

There may be situations where you do want an account to not have a password, perhaps some service account or something, but this has nothing to do with making the account more secure and everything to do with practicality, convenience and/or functionality.

UPDATE: Just to add that adding a password when there isn’t one already as described by Serge Ballesta is of course going to introduce something that can be attacked.

enter image description here

2

The only time I've seen this confusion come up is in a large organization where InfoSec mandated the use of particular security hardening tools. The tools would sometimes have specific requirements on password strength and rotation, or they have requirements to have password authentication on sudo.

This leads to the awkward discussion of "no password" and the endless confusion from management. To be clear, I try to say "password authentication is not possible".

Rather than obtaining a security exemption from password requirements, or explaining it to an auditor, it becomes necessary to enable password authentication and create passwords.

This is generally less secure, introduces issues around lockouts and expiration affecting the more secure methods of access.

If you check your company's InfoSec policies and the standards they need to comply with, it might explain the policy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.