Security policy: servers without root/administrator password

Question

I am considering running public web and application servers with blank root/Administrator passwords, and I'm wondering whether this might be a bad policy.

I see several advantages of having no password. "No password" can't be brute-forced, lost, forgotten or end up in the wrong hands. Administrators will need to log in with their personal accounts, making it easier to see who has access and is doing what, instead of keeping track of who knows the root password. If you manage to lock yourself out, it's easy to reactivate any account with physical access to the machine.

I run mostly Ubuntu 14 and Windows Server 2008 servers, both of which refuse remote logins for accounts without passwords by default. The Linux machines are accessed via SSH, the Windows machines are accessed via RDP, as well as SSH through Copssh. The server is physically protected enough for practical purposes, anybody who manages to gain access would be able to do damage anyway, regardless of passwords.

The question is, may this a good security policy or are there practical considerations here I haven't thought of? Specifically, are there any particular services in Windows or Linux that may allow remote access to a machine, through accounts with blank passwords?

Answer 1

Speaking from a Windows standpoint: Blank passwords can absolutely be brute-forced. Pen testers do it all the time. It seems to me that at that point a user with enough access to map a drive could replace a service executable and then restart the service remotely, for example.

From a linux standpoint, anyone with a valid login would then be able to su to root.

In other words, no, I would not use this as a security policy.

Answer 2

You're right that your admins should be using individual user accounts. Shared accounts are a bad idea all around.

On the Windows side the blank password idea seems pretty bad. Anyone who manages to get unprivileged local code execution on a machine will have a much easier time of escalating privileges with a blank RID 500 Administrator password, in my opinion. Even with the policy setting to limit blank password logons to the console you're running a risk that Microsoft has missed a method to utilize a blank password remotely.

No one needs the Windows RID 500 Administrator password, so "keeping track" of the people who know it is unnecessary. Set it to a long, random, high-entropy string during installation, physically document it, and lock up that physical documentation.

The risk / reward equation of this blank password strategy seems out of balance to me.

Answer 3

Don't even think about giving the root user a blank password. If you do this, it's trivial to leverage a non-root compromise into a root compromise.

Consider one of many possible scenarios:

An attacker uses an unpatched vulnerability to compromise the web server or the application the web server is serving. He gets a shell running as the web server's user. With a blank root password, he merely needs to execute su and he now has root.

Answer 4

I think current answers do not answer the question in full. Original question says "I see several advantages of having no password." and yet all answers talk about blank passwords.

So the question is: is blank the same as none?

Currently, hosting providers offer the possibility of setting up servers with uploaded public SSH Keys. This is quite convenient as it means one less thing to do when setting up new servers.

Since DigitalOcean has been mentioned it is relevant to point out that in this situation

When using SSH-keys, no root password is set.

This is certainly not the same as saying that root user has a blank password (I'm thinking empty is not the same as undefined sort of thing)

So the question now is whether root accounts can be set without a password at all. In an ideal world, I guess this would be even more secure than having any imaginable password, as there is none to match. But I wouldn't say I'm 100% sure about this. Could someone confirm this?

EDIT: It turns out that my guess will remain in an ideal world for a while. I created a support ticket in DigitalOcean and the answer included the following:

That is correct that no root password is set when using ssh-keys. It is recommended to use "passwd" once you have logged in to set one.

So that's that. It's safe to use SSH private keys during initial setup but passwd has to be performed still.