← Back to IBM AIX 7.x Security Technical Implementation Guide

V-215302

CAT II (Medium)

The AIX SSH daemon must be configured to disable empty passwords.

Rule ID

SV-215302r991591_rule

STIG

IBM AIX 7.x Security Technical Implementation Guide

Version

V3R2

CCIs

CCI-000366

Discussion

When password authentication is allowed, PermitEmptyPasswords specifies whether the server allows login to accounts with empty password strings. If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.

Check Content

Check the SSH daemon configuration for allowed empty passwords using command: 

# grep -i PermitEmptyPasswords /etc/ssh/sshd_config | grep -v '^#' 
PermitEmptyPasswords no

If no lines are returned, or the returned "PermitEmptyPasswords" directive contains "yes", this is a finding.

Fix Text

Edit "/etc/ssh/sshd_config" and add or edit the "PermitEmptyPasswords " line as:
PermitEmptyPasswords  no

Save the change and restart ssh daemon:
# stopsrc -s sshd
# startsrc -s sshd