[MEDIUM] allowNoPasswordLogin enabled on all hosts #22

New issue

Open

opened 2026-05-05 15:44:46 -05:00 by pjennings · 0 comments

pjennings commented

2026-05-05 15:44:46 -05:00

Owner

Labels: area:security, priority:medium, type:bug

Description

In modules/profiles/standard.nix:
users.allowNoPasswordLogin = lib.mkForce true;

This allows user accounts to exist without any password set.

Impact

Physical or console access to any VM allows passwordless login to accounts. While SSH key auth prevents remote exploitation, this is a weak defense-in-depth posture.

Recommended Fix

Set allowNoPasswordLogin = false. Set passwords for all interactive accounts or lock them with '!'.

**Labels:** area:security, priority:medium, type:bug ## Description In modules/profiles/standard.nix: users.allowNoPasswordLogin = lib.mkForce true; This allows user accounts to exist without any password set. ## Impact Physical or console access to any VM allows passwordless login to accounts. While SSH key auth prevents remote exploitation, this is a weak defense-in-depth posture. ## Recommended Fix Set allowNoPasswordLogin = false. Set passwords for all interactive accounts or lock them with '!'.