Debian is login without password

Kernels & Hardware, configuring network, installing services

Debian is login without password

Postby omixam » 2017-05-19 03:06

Recently I uninstall and install KDE, but after that my debian distribution is login without password.

By example, in the login screen I only need to press enter without type the password and I log in into my usser account. And the other hand, when I typed
Code: Select all
su
command in the termial, the terminal start root mode without request me the root`s password.

Also, if I tried to change the root or non-root password with
Code: Select all
passwd
command it is not request me that enter any new password.

Someone has an idea, how can I solve this issue?

Code: Select all
passwd
passwd: password updated successfully


The current distro version installed:

Distributor ID: Debian
Description: Debian GNU/Linux 9.0 (stretch)
Release: 9.0
Codename: stretch

KDE plasmashell 5.8.6

omixam
 
Posts: 22
Joined: 2014-04-27 23:47

Re: Debian is login without password

Postby debiman » 2017-05-19 05:32

very weird.
have a look at the contents of /etc/passwd and /etc/shadow.

give your self and the root user a new password.
does it persist, or is it changed back to nothing again?
User avatar
debiman
 
Posts: 1626
Joined: 2013-03-12 07:18

Re: Debian is login without password

Postby omixam » 2017-05-20 01:28

See bellow the output of the files that you mention:

/etc/passwd
normal user
user_name:x:user_id:group_id:user_name,,,:/home/user_name:/bin/bash

the encrypted password has a x value.

/etc/shadow
for normal user I have something like that:
user_name::0:0:99999:7:::

How you can see the second parameter is blank it is not password, but if I tried to change password to user with passwd do not work.

for root user
root:no_encrypted_password:17302:0:99999:7:::

root has password, but is not encrypted, that is too weird. However, root password is not requested nowhere.

When I run passwd I get the following message:
passwd: password updated successfully
Last edited by omixam on 2017-05-21 15:53, edited 3 times in total.
omixam
 
Posts: 22
Joined: 2014-04-27 23:47

Re: Debian is login without password

Postby debiman » 2017-05-20 07:02

you shouldn't post those online. remove for your own sake.
read
Code: Select all
man passwd
man 5 shadow
and draw your own conclusions.

why don't you just do what i suggested in my previous post?
give your self and the root user a new password.
does it persist, or is it changed back to nothing again?
User avatar
debiman
 
Posts: 1626
Joined: 2013-03-12 07:18

Re: Debian is login without password

Postby ruffwoof » 2017-05-20 11:36

There is something weird going on in Stretch. I've noticed that if you create a sfs of a installation, add live-boot to that and boot as though a liveCD (or a new install) ... then all terminals are automatically logged in. The same also occurs in Devuan's RC1. So even if you lock-screen to leave the PC for a while anyone else can get around that by Ctrl-Alt-Fn to another terminal session where its already logged in.

Indications are that there may be a common security flaw that's yet to be identified/resolved.
Debian oldstable, twm, yad, stalonetray
Acer Aspire M3201 (2GB), AMD Phenom X4
ruffwoof
 
Posts: 216
Joined: 2016-08-20 21:00

Re: Debian is login without password

Postby omixam » 2017-05-27 02:21

Any update for this issue?
omixam
 
Posts: 22
Joined: 2014-04-27 23:47


Return to System configuration

Who is online

Users browsing this forum: No registered users and 5 guests

fashionable