No Password, and the Root Account

Finding an account with no password

An account with no password is a door with no lock. Finding one is worth points, and it takes one file.

Open the password file

sudo nano /etc/shadow

One line per account. The part between the first and second colon is the password, stored scrambled:

yaga:$y$j9T$abc123...:19700:1:90:7:::
 │        │
 │        └── the scrambled password
 └─────────── the name

Now look at what can appear there:

You are hunting for the second row: a line that reads name:: with nothing in between. Leave with Ctrl+X.

💡 Empty and ! look similar and mean opposite things. ! is a lock. Empty is an open door.

Fixing it

Easiest way is the settings panel:

Settings  →  Users  →  Unlock  →  click the account  →  Password

Or in a terminal:

sudo passwd NAME

Locking the root account

Ubuntu normally ships with root locked, and the checker usually wants it that way. One command:

sudo passwd -l root

To check what it is now:

sudo passwd -S root

That prints L for locked, P for a usable password, or NP for none.

💡 A strong root password is not the same as a locked root account. The check is for the lock, so setting a long password instead scores nothing.

Try it yourself

sudo nano /etc/shadow    # find the line with nothing between the first two colons
sudo passwd -S root      # is root locked?