I think this appeared after the pam config changes. Thorsten, is is possible
to get rid of the prompt for an empty password?

This has nothing to do with the PAM config changes.
If you wish that people login without password, use pam_permit.so instead of pam_unix2.so.

Just had a talk with Thorsten and requiring the prompt was a change
wanted by the security team. pam_permit OTOH, is probably not so good
if you, say, get the idea to start an sshd in your rescue system. He'll
give it some thoughts...

I changed it, so that:
- If the password is empty and somebody enters a password, login will fail
- If the account is known before and the password empty, pam_unix2 will not ask for a password.

But if the account is not known before, the current behavior will stay and we will ask for a password. But this should not be the case on the rescue system.

close it