4

I'm running the latest Raspbian image on a Model B. I attempted to create a null password by using passwd -d, blanking the password field for the user in /etc/shadow, and setting PermitEmptyPasswords yes in /etc/ssh/sshd_config. This allows me password-less login over tty, but not ssh.

When I try to connect via SSH, I get the following in my auth.log:

sshd[8351]: Failed password for root from [my ip] port 49861 ssh2

I read that when OpenSSH is using PAM, you have to add "nullok" to the auth line in /etc/pam.d/sshd, so I amended mine as follows:

auth       required     pam_env.so nullok
auth       required     pam_env.so envfile=/etc/default/locale nullok

But then I just get this in auth.log:

sshd[4418]: pam_env(sshd:setcred): unknown option: nullok

Now, I'm well aware of the security risks of this, but this Raspberry Pi is going to live on a local switch that will never be connected to a public network. I know I could set up private key login, but I'd rather not have to add each device's public key if I can avoid it. Is there any way to get null passwords working on this distro? I'm not too familiar with it, other than that it's Debian-based.

Edit to add: I also have PermitRootLogin yes set, and can login to this account when it has a non-blank password set, so it's not the fact that I'm trying to log into the root account. I tried making a different account, and I still get "failed password for ..."

3

The nullok option can be used with the pam_unix.so and not the pam_env.so.

If pam_unix is installed in your Pi (most probably, it is), then this line will do the trick

auth       required     pam_unix.so nullok

EDIT: I just found some time to play around. I managed to make it work. Given that all the settings in sshd and pam.d are ok, you need to manually edit your /etc/shadow file and place this

U6aMy0wojraho

in the password field of all users you want to allow passwordless access. As you already know, passwords are hashed in the shadow file. The above string is the hash of nothing in raspbian's default hashing algorithm.

  • Thanks for the heads up! That fixed the pam_env error, but it's still failing to login with a null pass: raspberrypi sshd[19216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=macbookpro.lan user=root and then raspberrypi sshd[19216]: Failed password for root from 192.168.1.51 port 58094 ssh2 – nearengine Oct 31 '13 at 15:11
  • I've edited my answer with a solution, tested and working. Being a security geek myself, I can only wish that you enjoy your intentional security hole! :) – foibs Oct 31 '13 at 19:04
  • Thanks! Clever, it works great. The only people that could SSH into this would be in the room and plugged in, so I'd have much bigger problems :P – nearengine Nov 1 '13 at 0:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.