Pluggable Authentication Modules (PAM)

Allow chfn without password

/etc/pam.d/chfn
#%PAM-1.0
auth	   sufficient   pam_rootok.so
auth	   sufficient   pam_succeed_if.so uid >= 1000 quiet_success
[…]