Detections
Analytics

5.1.21 Ensure sshd PermitEmptyPasswords is disabled

Information

The PermitEmptyPasswords parameter specifies if the SSH server allows login to accounts with empty password strings.

More information about the openSSH server configuration is available in the "Configure SSH Server" section overview.

Disallowing remote shell access to accounts that have an empty password reduces the probability of unauthorized access to the system.

Solution

Create or edit a *.conf file in the /etc/ssh/sshd_config.d/ and set the PermitEmptyPasswords parameter to no above any Include and Match entries as follows:

PermitEmptyPasswords no

Run the following command to apply the configuration change to the running sshd daemon without interrupting active sessions:

# systemctl reload sshd

See Also

https://workbench.cisecurity.org/benchmarks/27797

Item Details

Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: 4285658f647cb9741f769f8bc7ca8d5ea4c2c28de96e1291816267cc5b74deb8