Detections
Analytics

5.1.20 Ensure sshd PermitEmptyPasswords is disabled

Information

The PermitEmptyPasswords parameter specifies if the SSH server allows login to accounts with empty password strings.

Disallowing remote shell access to accounts that have an empty password reduces the probability of unauthorized access to the system.

Solution

Edit /etc/ssh/sshd_config and set the PermitEmptyPasswords parameter to no above any Include and Match entries as follows:

PermitEmptyPasswords no

The SSH daemon must be restarted for the changes to take effect. To restart the SSH daemon, run the following command:

# systemctl reload-or-restart sshd.service

Impact:

This setting is the default. Ensuring PermitEmptyPasswords is no prevents login to accounts that have an empty password; any account intentionally configured without a password will be unable to authenticate over SSH and must be given a credential or an alternative access method.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|CM-6b., 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: c2303172da7b54f7e2b1c7062e853b88e9e61e25ab1b68dd7dc33488b5db2bd6