View source for Create a Linux User with an Empty Password

I had a need to create a 'guest’ account in one of my Linux installs which allows anonymous users within a trusted intranet to login to a specially crafted script. One of the issues that I was faced with was with {{code|passwd}} refusing to accept a blank password. To let empty password logins, we must manually change the account password.

When we look at {{code|/etc/shadow}}, we will see something similar to:

{{highlight|lang=text|code=
username:$1$ADUODeAy$gRz7rO6P5lFcPpYwqd7Eb0:14929:0:99999:7:::
}}

The second field containing {{code|$1$ADUODeAy$gRz7rO6P5lFcPpYwqd7Eb0}} is the password hash. The hash is delimited by {{code|$}} and contains the following data:
# {{code|1}} denotes that the hash is a MD5 hash
# {{code|ADUODeAy}} is the salt
# {{code|gRz7rO6P5lFcPpYwqd7Eb0}} is the actual password hash in MD5


To generate this hash manually, we can use {{code|openssl}}. We could use a different salt, but in this example, we use the same existing salt value.
{{highlight|lang=terminal|code=
# openssl passwd -1 -salt ADUODeAy
Password: [enter]
$1$ADUODeAy$eCJ1lPSxhSGmSvrmWxjLC1
}}

Note that the first parameter, {{code|-1}}, tells openssl to use MD5 to generate the hash.

Replace the existing hash in {{code|/etc/shadow}} with the hash generated by openssl. The account now essentially has an empty password.

Notes:
* You will need to temporarily change the permission of {{code|/etc/shadow}} in order to write to it.
* You will need to enable 'PermitEmptyPasswords' in {{code|/etc/ssh/sshd_config}} for empty password logins to work
* This can easily be a security risk to your machine! Ensure the account and server is locked down or use SSH keys for password-less logins! Remember, by default, users can SSH tunnel through this guest account. You must consider the implications of enabling such an account on your machine.

{{Navbox Linux}}[[Category:Linux]]