Bug 1223436 - cannot login without password set
Summary: cannot login without password set
Status: NEW
Alias: None
Product: openSUSE Tumbleweed
Classification: openSUSE
Component: Basesystem (show other bugs)
Version: Current
Hardware: x86-64 openSUSE Tumbleweed
: P5 - None : Critical (vote)
Target Milestone: ---
Assignee: E-mail List
QA Contact: E-mail List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-04-26 16:39 UTC by Bruno Pitrus
Modified: 2024-07-19 21:56 UTC (History)
2 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Bruno Pitrus 2024-04-26 16:39:50 UTC 
After updating a Tumbleweed VM without any password set either on the user account, or on root, it has locked me out — i can login neither from SDDM, nor from the kernel console.

The previous update of that machine was about a month ago (after the lzma backdoor rebuild).
Comment 1 Bruno Pitrus 2024-04-26 16:43:52 UTC 
My line in /etc/passwd looks like

bruno:x:1000:100::/home/bruno:/usr/bin/fish

My line in /etc/shadow looks like

bruno:U6aMy0wojraho:18956:0:99999:7:::

(which is the well-known hash of an empty password)
Comment 2 Thorsten Kukuk 2024-04-29 06:21:21 UTC 
(In reply to Bruno Pitrus from comment #1)

> (which is the well-known hash of an empty password)

       nullok
           The default action of this module is to not permit the user access
           to a service if their official password is blank. The nullok
           argument overrides this default.

I bet you did not set the "nullok" option and it only worked due to a bug?
Comment 3 Thorsten Kukuk 2024-04-29 06:28:46 UTC 
The upstream bug: https://github.com/linux-pam/linux-pam/issues/758
Comment 4 Bruno Pitrus 2024-04-29 07:13:06 UTC 
(In reply to Thorsten Kukuk from comment #2)
> (In reply to Bruno Pitrus from comment #1)
> 
> > (which is the well-known hash of an empty password)
> 
>        nullok
>            The default action of this module is to not permit the user access
>            to a service if their official password is blank. The nullok
>            argument overrides this default.
> 
> I bet you did not set the "nullok" option and it only worked due to a bug?

It worked out of the box for many years. I do not remember changing any PAM settings, only /etc/sudoers.
Comment 5 Chenzi Cao 2024-07-16 15:38:37 UTC 
Hi Bruno, is the issue still reproducible now please?
Comment 6 Bruno Pitrus 2024-07-19 21:56:12 UTC 
(In reply to Chenzi Cao from comment #5)
> Hi Bruno, is the issue still reproducible now please?

It's still broken.