Title

OSX00180-SSH must not allow empty passwords. (Cat I impact)

Discussion

Denies access to accounts without passwords. This should be set for all SSH methods of authenticating.

Check Content

Open a terminal session and enter the command. more /etc/sshd_config If the value of PermitEmptyPasswords is set to Yes, this is a finding. If the PermitEmptyPasswords option is not set, this is not a finding.

Fix Text

Open a terminal session and edit the following file. /etc/sshd_config Set the value of PermitEmptyPasswords to No.

Additional Identifiers

Rule ID: SV-40699r1_rule

Vulnerability ID: V-25276

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.