Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Recently I've been thinking about how I installed my linux system (I went for debian). When I installed it, I chose not to enter password for root and only entered password for my user account. My question is whether it can be somehow exploited and is it possible to login as root when I didn't provide any password? I tried
su
Password:
but mine password obviously didn't work. Thank you!
If you are worried about something or someone abusing this lapse and ending up logging in as root, don't worry: if root has no password set, no password will match and plain common login with that account (tty login, SSH login, X login, et al) will not be allowed.
But the account is still accessible: you can sudo su and become root. After that you can add a public key to /root/.ssh/authorized_keys and SSH-in as root.
But none of those methods will work when you don't have sudo powers, and you are probably the only one with that power on your system.
