Debian is login without password

[omixam]

Recently I uninstall and install KDE, but after that my debian distribution is login without password.

By example, in the login screen I only need to press enter without type the password and I log in into my usser account. And the other hand, when I typed

Code: Select all

su

command in the termial, the terminal start root mode without request me the root`s password.

Also, if I tried to change the root or non-root password with

Code: Select all

passwd

command it is not request me that enter any new password.

Someone has an idea, how can I solve this issue?

Code: Select all

passwd 
passwd: password updated successfully

The current distro version installed:

Distributor ID: Debian
Description: Debian GNU/Linux 9.0 (stretch)
Release: 9.0
Codename: stretch

KDE plasmashell 5.8.6

[debiman]

very weird.
have a look at the contents of /etc/passwd and /etc/shadow.

give your self and the root user a new password.
does it persist, or is it changed back to nothing again?

[omixam]

See bellow the output of the files that you mention:

/etc/passwd
normal user

user_nameuser_id:group_id:user_name,,,:/home/user_name:/bin/bash

the encrypted password has a x value.

/etc/shadow
for normal user I have something like that:

user_name::0:0:99999:7:::

How you can see the second parameter is blank it is not password, but if I tried to change password to user with passwd do not work.

for root user

root:no_encrypted_password0:99999:7:::

root has password, but is not encrypted, that is too weird. However, root password is not requested nowhere.

When I run passwd I get the following message:

passwd: password updated successfully

[debiman]

you shouldn't post those online. remove for your own sake.
read

Code: Select all

man passwd
man 5 shadow

and draw your own conclusions.

why don't you just do what i suggested in my previous post?

give your self and the root user a new password.
does it persist, or is it changed back to nothing again?

[ruffwoof]

There is something weird going on in Stretch. I've noticed that if you create a sfs of a installation, add live-boot to that and boot as though a liveCD (or a new install) ... then all terminals are automatically logged in. The same also occurs in Devuan's RC1. So even if you lock-screen to leave the PC for a while anyone else can get around that by Ctrl-Alt-Fn to another terminal session where its already logged in.

Indications are that there may be a common security flaw that's yet to be identified/resolved.

[omixam]

Any update for this issue?