[PATCH] su: support denying accounts with blank password

[Natanael Copa]

On Wed, 14 Oct 2015 05:43:32 -0400
Michael Conrad <mconrad at intellitree.com> wrote:

> On 10/14/2015 2:37 AM, Natanael Copa wrote:
> > The security is based on physical access. The local technician can log
> > in without password. (in theory, if you have physical access then you
> > have access to it all anyway). And after all, it is the "local technician"
> > the device is supposed to protect anyway.
> 
> Why run 'login' at all?  You can just run "agetty -l /bin/bash" from 
> init or runit and always have a shell ready.

This is a valid alternative approach that has been discussed.

The drawback is that if you actually want a root password you will have
to edit /etc/inittab while with 'su' you'll only need set password.

This actually matters for me because i want use no password as default
for the alpine linux LXC template. Then you can just create the
container and set password. If you forget the set password step you are
still more or less safe. (sshd default config disallows root login with
empty password).

> Alternatively you can randomize the password and print it on the
> console with the welcome message.

This is an interesting idea.
 
> Just some other ideas.
> -Mike
> _______________________________________________
> busybox mailing list
> busybox at busybox.net
> http://lists.busybox.net/mailman/listinfo/busybox