I am considering running public web and application servers with blank root/Administrator passwords, and I'm wondering whether this might be a bad policy.
I see several advantages of having no password. "No password" can't be brute-forced, lost, forgotten or end up in the wrong hands. Administrators will need to log in with their personal accounts, making it easier to see who has access and is doing what, instead of keeping track of who knows the root password. If you manage to lock yourself out, it's easy to reactivate any account with physical access to the machine.
I run mostly Ubuntu 14 and Windows Server 2008 servers, both of which refuse remote logins for accounts without passwords by default. The Linux machines are accessed via SSH, the Windows machines are accessed via RDP, as well as SSH through Copssh. The server is physically protected enough for practical purposes, anybody who manages to gain access would be able to do damage anyway, regardless of passwords.
The question is, may this a good security policy or are there practical considerations here I haven't thought of? Specifically, are there any particular services in Windows or Linux that may allow remote access to a machine, through accounts with blank passwords?
root:*:...
forgetent shadow root
the password is not blank, the account is disabled for password authentication. A blank password would look likeroot::...
and that is very bad.