@@ -449,16 +449,10 @@ in {
449449 imports = [
450450 (mkAliasOptionModule [ "users" "extraUsers" ] [ "users" "users" ])
451451 (mkAliasOptionModule [ "users" "extraGroups" ] [ "users" "groups" ])
452− (mkChangedOptionModule
453− [ "security" "initialRootPassword" ]
454− [ "users" "users" "root" "initialHashedPassword" ]
455− (cfg: if cfg.security.initialRootPassword == "!"
456− then null
457− else cfg.security.initialRootPassword))
452+ (mkRenamedOptionModule ["security" "initialRootPassword"] ["users" "users" "root" "initialHashedPassword"])
458453 ];
459454
460455 ###### interface
461−
462456 options = {
463457
464458 users.mutableUsers = mkOption {
@@ -526,6 +520,17 @@ in {
526520 '';
527521 };
528522
523+
524+ users.allowNoPasswordLogin = mkOption {
525+ type = types.bool;
526+ default = false;
527+ description = ''
528+ Disable checking that at least the <literal>root</literal> user or a user in the <literal>wheel</literal> group can log in using
529+ a password or an SSH key.
530+
531+ WARNING: enabling this can lock you out of your system. Enable this only if you know what are you doing.
532+ '';
533+ };
529534 };
530535
531536
@@ -540,6 +545,7 @@ in {
540545 home = "/root";
541546 shell = mkDefault cfg.defaultUserShell;
542547 group = "root";
548+ initialHashedPassword = mkDefault "!";
543549 };
544550 nobody = {
545551 uid = ids.uids.nobody;
@@ -616,9 +622,11 @@ in {
616622 # there is at least one "privileged" account that has a
617623 # password or an SSH authorized key. Privileged accounts are
618624 # root and users in the wheel group.
619− assertion = !cfg.mutableUsers ->
620− any id ((mapAttrsToList (_: cfg:
621− (cfg.name == "root"
625+ # The check does not apply when users.disableLoginPossibilityAssertion
626+ # The check does not apply when users.mutableUsers
627+ assertion = !cfg.mutableUsers -> !cfg.allowNoPasswordLogin ->
628+ any id (mapAttrsToList (name: cfg:
629+ (name == "root"
622630 || cfg.group == "wheel"
623631 || elem "wheel" cfg.extraGroups)
624632 &&
@@ -629,10 +637,14 @@ in {
629637 || cfg.openssh.authorizedKeys.keyFiles != [])
630638 ) cfg.users) ++ [
631639 config.security.googleOsLogin.enable
632− ]);
640+ ];
633641 message = ''
634642 Neither the root account nor any wheel user has a password or SSH authorized key.
635− You must set one to prevent being locked out of your system.'';
643+ You must set one to prevent being locked out of your system.
644+ If you really want to be locked out of your system, set users.allowNoPasswordLogin = true;
645+ However you are most probably better off by setting users.mutableUsers = true; and
646+ manually running passwd root to set the root password.
647+ '';
636648 }
637649 ] ++ flatten (flip mapAttrsToList cfg.users (name: user:
638650 [