# How to get null passwords over SSH working on Raspbian?

I'm running the latest Raspbian image on a Model B. I attempted to create a null password by using passwd -d, blanking the password field for the user in /etc/shadow, and setting PermitEmptyPasswords yes in /etc/ssh/sshd_config. This allows me password-less login over tty, but not ssh.

When I try to connect via SSH, I get the following in my auth.log:

sshd[8351]: Failed password for root from [my ip] port 49861 ssh2


I read that when OpenSSH is using PAM, you have to add "nullok" to the auth line in /etc/pam.d/sshd, so I amended mine as follows:

auth       required     pam_env.so nullok
auth       required     pam_env.so envfile=/etc/default/locale nullok


But then I just get this in auth.log:

sshd[4418]: pam_env(sshd:setcred): unknown option: nullok


Now, I'm well aware of the security risks of this, but this Raspberry Pi is going to live on a local switch that will never be connected to a public network. I know I could set up private key login, but I'd rather not have to add each device's public key if I can avoid it. Is there any way to get null passwords working on this distro? I'm not too familiar with it, other than that it's Debian-based.

Edit to add: I also have PermitRootLogin yes set, and can login to this account when it has a non-blank password set, so it's not the fact that I'm trying to log into the root account. I tried making a different account, and I still get "failed password for ..."

The nullok option can be used with the pam_unix.so and not the pam_env.so.

If pam_unix is installed in your Pi (most probably, it is), then this line will do the trick

auth       required     pam_unix.so nullok


EDIT: I just found some time to play around. I managed to make it work. Given that all the settings in sshd and pam.d are ok, you need to manually edit your /etc/shadow file and place this

U6aMy0wojraho

in the password field of all users you want to allow passwordless access. As you already know, passwords are hashed in the shadow file. The above string is the hash of nothing in raspbian's default hashing algorithm.

• Thanks for the heads up! That fixed the pam_env error, but it's still failing to login with a null pass: raspberrypi sshd[19216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=macbookpro.lan user=root and then raspberrypi sshd[19216]: Failed password for root from 192.168.1.51 port 58094 ssh2 – nearengine Oct 31 '13 at 15:11
• I've edited my answer with a solution, tested and working. Being a security geek myself, I can only wish that you enjoy your intentional security hole! :) – foibs Oct 31 '13 at 19:04
• Thanks! Clever, it works great. The only people that could SSH into this would be in the room and plugged in, so I'd have much bigger problems :P – nearengine Nov 1 '13 at 0:20

passwd -d will not set the password to an empty string, it will delete the password altogether, making it impossible for the user to log in using a password.
Setting an empty password (without manually editing /etc/shadow) can be done using
echo pi:openssl passwd -salt xx "" | sudo chpasswd -e

The first part of the command outputs the username, a : separator and an empty password hashed with a chosen salt value (here: xx). The second part sets the password for the user, -e meaning the password is already encrypted. Encrypting the password is necessary because chpasswd does not accept empty strings.