Currently PAM and dropbear allow logins but openssh doesn't (patch sent for that). It would be nice to have a global knob to change this behaviour for all affected recipes.
There is following configuration in /etc/pam.d/common-auth file on target: auth [success=1 default=ignore] pam_unix.so nullok About nullok argument: nullok The default action of this module is to not permit the user access to a service if their official password is blank. The nullok argument overrides this default and allows any user with a blank password to access the service. So, we can use this argument to decide whether allow empty password login.
Hi Koen, Can you describe this defect in detail?
Assigned to Koen Kooi since that is who should supply the NEEDINFO per RP.
The ability to do an empty password login is provided by debug-tweaks, but it also happens to do other things that may be less then desired. I'm updating this to be an enhancement request that breaks up the debug-tweaks functionality into logical units so they can be individually used. Change summary from: Add knob to (dis)allow empty password login for PAM/dropbear/openssh/etc to: Split up IMAGE_FEATURES - debug-tweaks into logical components Suggested enhancement: Split debug-tweaks into it's logical components: empty-root-password - run zap_empty_root_password allow-empty-password - run ssh_allow_empty_password post-install-logging - run postinst_enable_logging Map "debug-tweaks" to enabled those three items.
http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=d42963a3feda6c4cf074cbdacc7cf904734d70cf ScottR, docs will need to add definitions for the split values of debug-tweaks as enumerated by Mark in the above comment.
Hi, The documentation changes for this fix are here: http://www.yoctoproject.org/docs/1.8/ref-manual/ref-manual.html#var-EXTRA_IMAGE_FEATURES. http://www.yoctoproject.org/docs/1.8/ref-manual/ref-manual.html#ref-features-image (see the 'allow-empty-password', 'debug-tweaks', 'empty-root-password', and 'post-install-logging' items in the feature list. Since the bug is already set to RESOLVED, I am simply posting notice that these changes are in. If there are issues, let me know here. I also set the documentation flag to "done". Thanks, Scott