← Back to Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide

V-282493

CAT I (High)

TOSS 5 SSHD must not allow blank or null passwords.

Rule ID

SV-282493r1200459_rule

STIG

Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-000766

Discussion

If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.

Check Content

Verify TOSS 5 remote access using SSH prevents logging on with a blank password using the following command:

$ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*permitemptypasswords'

PermitEmptyPassword no

If the "PermitEmptyPassword" keyword is set to "yes", is missing, or is commented out, this is a finding.

Fix Text

Configure the system to prevent SSH users from logging on with blank passwords by editing the following line in "etc/ssh/sshd_config":

PermitEmptyPasswords no

Restart the SSH daemon for the settings to take effect:

$ sudo systemctl restart sshd.service