3 ms·

What exactly is meant by null? The null / zero character, no password or 4-char string "null"?

paulddraper 7y ago
The NUL character is not allowed in a Linux password. Also the text of the CVE is more clear. > contain a NULL password for the `root` user It's no password.
RKearney 7y ago
NULL as in there is no password of any kind configured.
adrianmonk 7y ago
It's sloppy writing. They mean it is the empty string in /etc/shadow. Following some links from the CVE, you can find the details (from https://talosintelligence.com/vulnerability_reports/TALOS-2019-0782 https://talosintelligence.com/vulnerability_reports/TALOS-20...): > In builds of the Alpine Docker Image (>=3.3) the /etc/shadow file contains a blank field in place of the encrypted password > ... > The net result of a blank sp_pwdp field is that the system will treat the root user as having no password, rather than a 'locked' account if a ! or is explicitly specified.* For those not super familiar with how Unix/Linux password files work, if the field is non-empty, the system will collect a password, hash it, and compare for a match. If the field is empty, the system will just skip prompting for a password and log you in after entering a username. Arguably, this is crappy design and a better design for /etc/shadow would be to require some kind of explicit, very obvious value like "NO-PASSWORD-REQUIRED".
- Drdrdrq 7y ago
  Thanks!
- jlgaddis 7y ago
  > Arguably, this is crappy design and a better design for /etc/shadow would be to require some kind of explicit, very obvious value like "NO-PASSWORD-REQUIRED". I think pretty much all Linux distributions use PAM nowadays (although I'm sure there are exceptions). From pam_unix.so(8): > The default action of this module is to not permit the user access to a service if their official password is blank. Unfortunately, many distributions pass the "nullok" option to the pam_unix.so module, overriding this default behavior. Removing any instances of "nullok" from any files in /etc/pam.d/ is highly recommended -- unless you explicitly want this behavior (which could be a reasonable choice, in some specific use cases).

The NUL character is not allowed in a Linux password. Also the text of the CVE is more clear. > contain a NULL password for the `root` user It's no password.

RKearney 7y ago

NULL as in there is no password of any kind configured.

adrianmonk 7y ago

It's sloppy writing. They mean it is the empty string in /etc/shadow. Following some links from the CVE, you can find the details (from https://talosintelligence.com/vulnerability_reports/TALOS-2019-0782 https://talosintelligence.com/vulnerability_reports/TALOS-20...): > In builds of the Alpine Docker Image (>=3.3) the /etc/shadow file contains a blank field in place of the encrypted password > ... > The net result of a blank sp_pwdp field is that the system will treat the root user as having no password, rather than a 'locked' account if a ! or is explicitly specified.* For those not super familiar with how Unix/Linux password files work, if the field is non-empty, the system will collect a password, hash it, and compare for a match. If the field is empty, the system will just skip prompting for a password and log you in after entering a username. Arguably, this is crappy design and a better design for /etc/shadow would be to require some kind of explicit, very obvious value like "NO-PASSWORD-REQUIRED".

Drdrdrq 7y ago
Thanks!
jlgaddis 7y ago
> Arguably, this is crappy design and a better design for /etc/shadow would be to require some kind of explicit, very obvious value like "NO-PASSWORD-REQUIRED". I think pretty much all Linux distributions use PAM nowadays (although I'm sure there are exceptions). From pam_unix.so(8): > The default action of this module is to not permit the user access to a service if their official password is blank. Unfortunately, many distributions pass the "nullok" option to the pam_unix.so module, overriding this default behavior. Removing any instances of "nullok" from any files in /etc/pam.d/ is highly recommended -- unless you explicitly want this behavior (which could be a reasonable choice, in some specific use cases).