Detections
Analytics
WN25-SH-000040 - Windows Server 2025 OpenSSH must not allow blank passwords.
Information
If an account has an empty password, anyone could log on and run commands with the privileges of that account. Accounts with empty passwords must never be used in operational environments.Satisfies: SRG-OS-000106-GPOS-00053, SRG-OS-000480-GPOS-00229, SRG-OS-000480-GPOS-00228
Solution
To configure the system, add or modify the following line in the '$env:ProgramData/ssh/sshd_config' file:PermitEmptyPasswords no
Restart the OpenSSH service for the settings to take effect.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_Server_2025_V1R3_STIG.zip
Item Details
Audit Name: DISA Microsoft Windows Server 2025 STIG v1r3
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-2(2), CAT|I, CCI|CCI-000766, Rule-ID|SV-285316r1211176_rule, STIG-ID|WN25-SH-000040, Vuln-ID|V-285316
Plugin: Windows
Control ID: 0e56903b892722f3f29516e818f8e392b84af0ad27eaf9eedfe84532a5a2020d