5.2.11 Ensure SSH PermitEmptyPasswords is disabled

Information

The PermitEmptyPasswords parameter specifies if the SSH server allows login to accounts with empty password strings.

Rationale:

Disallowing remote shell access to accounts that have an empty password reduces the probability of unauthorized access to the system

Solution

Edit the /etc/ssh/sshd_config file to set the parameter as follows:

PermitEmptyPasswords no

Restart sshd :

systemctl restart sshd

See Also

https://workbench.cisecurity.org/files/2449

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5, CSCv7|16.3

Plugin: Unix

Control ID: d83d5e3492252f2ce195a15512c88ab7a4606d5f5a3745ce3522dfef812a2cdc