I'm running the latest Raspbian image on a Model B. I attempted to create a null password by using passwd -d, blanking the password field for the user in /etc/shadow, and setting PermitEmptyPasswords yes in /etc/ssh/sshd_config. This allows me password-less login over tty, but not ssh.

When I try to connect via SSH, I get the following in my auth.log:

sshd[8351]: Failed password for root from [my ip] port 49861 ssh2

I read that when OpenSSH is using PAM, you have to add "nullok" to the auth line in /etc/pam.d/sshd, so I amended mine as follows:

auth       required     pam_env.so nullok
auth       required     pam_env.so envfile=/etc/default/locale nullok

But then I just get this in auth.log:

sshd[4418]: pam_env(sshd:setcred): unknown option: nullok

Now, I'm well aware of the security risks of this, but this Raspberry Pi is going to live on a local switch that will never be connected to a public network. I know I could set up private key login, but I'd rather not have to add each device's public key if I can avoid it. Is there any way to get null passwords working on this distro? I'm not too familiar with it, other than that it's Debian-based.

Edit to add: I also have PermitRootLogin yes set, and can login to this account when it has a non-blank password set, so it's not the fact that I'm trying to log into the root account. I tried making a different account, and I still get "failed password for ..."


2 Answers 2


The nullok option can be used with the pam_unix.so and not the pam_env.so.

If pam_unix is installed in your Pi (most probably, it is), then this line will do the trick

auth       required     pam_unix.so nullok

EDIT: I just found some time to play around. I managed to make it work. Given that all the settings in sshd and pam.d are ok, you need to manually edit your /etc/shadow file and place this


in the password field of all users you want to allow passwordless access. As you already know, passwords are hashed in the shadow file. The above string is the hash of nothing in raspbian's default hashing algorithm.

  • Thanks for the heads up! That fixed the pam_env error, but it's still failing to login with a null pass: raspberrypi sshd[19216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=macbookpro.lan user=root and then raspberrypi sshd[19216]: Failed password for root from port 58094 ssh2
    – nearengine
    Oct 31, 2013 at 15:11
  • I've edited my answer with a solution, tested and working. Being a security geek myself, I can only wish that you enjoy your intentional security hole! :)
    – foibs
    Oct 31, 2013 at 19:04
  • 1
    Thanks! Clever, it works great. The only people that could SSH into this would be in the room and plugged in, so I'd have much bigger problems :P
    – nearengine
    Nov 1, 2013 at 0:20

Answer specifically concerning the "empty password" part:

passwd -d will not set the password to an empty string, it will delete the password altogether, making it impossible for the user to log in using a password.

Setting an empty password (without manually editing /etc/shadow) can be done using

echo pi:`openssl passwd -salt xx ""` | sudo chpasswd -e

The first part of the command outputs the username, a : separator and an empty password hashed with a chosen salt value (here: xx). The second part sets the password for the user, -e meaning the password is already encrypted. Encrypting the password is necessary because chpasswd does not accept empty strings.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.