0

If I create a user in a Linux system with an empty password, does that expose any remote vulnerabilities, or is it only a problem if someone gains physical access to the machine?

Improve this question

2 Answers 2

Reset to default
6

If I create a user in a Linux system with an empty password, does that expose any remote vulnerabilities, or is it only a problem if someone gains physical access to the machine?

It does not expose a remote vulnerability, it is considered a misconfiguration which depends on:

  1. Your SSH configuration. Per default PermitEmptyPasswords is set to no in /etc/ssh/sshd_config.

  2. How the user itself is configured. If the user is allowed shell access or not which can be seen in /etc/passwd.

Assuming that both 1 and 2 apply, you need console (physical) access to your machine in order for this user to be able to login.

There should only be one reason for not setting a user's password and that's when public key authentication is configured. To avoid any confusion, there is a difference between user accounts (uid >= 1000) and service accounts (uid < 1000).

Improve this answer
0

If you allow this user access via ssh or ftp, this can be definitely a problem.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .