Title

The SSH daemon must not allow authentication using an empty password. (Cat I impact)

Discussion

Configuring this setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere.

Check Content

To determine how the SSH daemon's "PermitEmptyPasswords" option is set, run the following command: # grep -i PermitEmptyPasswords /etc/ssh/sshd_config If no line, a commented line, or a line indicating the value "no" is returned, then the required value is set. If the required value is not set, this is a finding.

Fix Text

To explicitly disallow remote login from accounts with empty passwords, add or correct the following line in "/etc/ssh/sshd_config": PermitEmptyPasswords no Any accounts with empty passwords should be disabled immediately, and PAM configuration should prevent users from being able to assign themselves empty passwords.

Additional Identifiers

Rule ID: SV-218001r603264_rule

Vulnerability ID: V-218001

Group Title: SRG-OS-000106

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.