It is possible to log in to an account without a password from a virtual terminal when the password is empty. On my system(Arch Linux), logging in with su and an empty password simply gives a wrong password notification.Can a program log in directly(without using su) with empty password?Note that this is a default Linux installation, without sudo,sshd or anything of the type. This also does not take into someone malicious physically logging in from the keyboard, since physical access is total compromise anyway.
What are the security implications of a user account with no password on linux?
linux;security;password
What are the security implications of a user account with no password on linux?That will make brute force attacks very efficient as they generally start with testing an empty password. The implications depend on how the system is configured. Some systems and services might not allow login using a passwordless account (e.g. pam_unix nullok option), or restrict such logins to some devices (e.g. see pam_unix nullok_secure option and /etc/securetty).Can a program log in directly(without using su) with empty password?A suid program can do it. A regular program might depending on the OS and on whether it is called from a login shell or not.