How to get null passwords over SSH working on Raspbian?

Question

I'm running the latest Raspbian image on a Model B. I attempted to create a null password by using passwd -d, blanking the password field for the user in /etc/shadow, and setting PermitEmptyPasswords yes in /etc/ssh/sshd_config. This allows me password-less login over tty, but not ssh.

When I try to connect via SSH, I get the following in my auth.log:

sshd[8351]: Failed password for root from [my ip] port 49861 ssh2

I read that when OpenSSH is using PAM, you have to add "nullok" to the auth line in /etc/pam.d/sshd, so I amended mine as follows:

auth       required     pam_env.so nullok
auth       required     pam_env.so envfile=/etc/default/locale nullok

But then I just get this in auth.log:

sshd[4418]: pam_env(sshd:setcred): unknown option: nullok

Now, I'm well aware of the security risks of this, but this Raspberry Pi is going to live on a local switch that will never be connected to a public network. I know I could set up private key login, but I'd rather not have to add each device's public key if I can avoid it. Is there any way to get null passwords working on this distro? I'm not too familiar with it, other than that it's Debian-based.

Edit to add: I also have PermitRootLogin yes set, and can login to this account when it has a non-blank password set, so it's not the fact that I'm trying to log into the root account. I tried making a different account, and I still get "failed password for ..."

Answer 1

The nullok option can be used with the pam_unix.so and not the pam_env.so.

If pam_unix is installed in your Pi (most probably, it is), then this line will do the trick

auth       required     pam_unix.so nullok

EDIT: I just found some time to play around. I managed to make it work. Given that all the settings in sshd and pam.d are ok, you need to manually edit your /etc/shadow file and place this

U6aMy0wojraho

in the password field of all users you want to allow passwordless access. As you already know, passwords are hashed in the shadow file. The above string is the hash of nothing in raspbian's default hashing algorithm.

Answer 2

Answer specifically concerning the "empty password" part:

passwd -d will not set the password to an empty string, it will delete the password altogether, making it impossible for the user to log in using a password.

Setting an empty password (without manually editing /etc/shadow) can be done using

echo pi:`openssl passwd -salt xx ""` | sudo chpasswd -e

The first part of the command outputs the username, a : separator and an empty password hashed with a chosen salt value (here: xx). The second part sets the password for the user, -e meaning the password is already encrypted. Encrypting the password is necessary because chpasswd does not accept empty strings.