Detections
Analytics

WN25-SH-000040 - Windows Server 2025 OpenSSH must not allow blank passwords.

Information

If an account has an empty password, anyone could log on and run commands with the privileges of that account. Accounts with empty passwords must never be used in operational environments.

Satisfies: SRG-OS-000106-GPOS-00053, SRG-OS-000480-GPOS-00229, SRG-OS-000480-GPOS-00228

Solution

To configure the system, add or modify the following line in the '$env:ProgramData/ssh/sshd_config' file:

PermitEmptyPasswords no

Restart the OpenSSH service for the settings to take effect.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_Server_2025_V1R4_STIG.zip

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2(2), CAT|I, CCI|CCI-000766, Rule-ID|SV-285316r1268229_rule, STIG-ID|WN25-SH-000040, Vuln-ID|V-285316

Plugin: Windows

Control ID: 70a66de067a1dda8e5406bc56e6c9dc7b5b511f406597cdfa26cb2501a610824