documentation_complete: true

title: 'Prevent Log In to Accounts With Empty Password'

description: |-
    If an account is configured for password authentication
    but does not have an assigned password, it may be possible to log
    onto the account without authentication. Remove any instances of the <tt>nullok</tt>
    option in <tt>/etc/pam.d/system-auth</tt> to
    prevent logins with empty passwords.

rationale: |-
    If an account has an empty password, anyone could log in and
    run commands with the privileges of that account. Accounts with
    empty passwords should never be used in operational
    environments.

severity: high

identifiers:
    cce: 27038-9

references:
    nist: IA-5(b),IA-5(c),IA-5(1)(a)
    pcidss: Req-8.2.3
    srg: SRG-OS-999999
    stigid: RHEL-06-000030

ocil_clause: 'NULL passwords can be used'

ocil: |-
    To verify that null passwords cannot be used, run the following command:
    <pre>$ grep nullok /etc/pam.d/system-auth</pre>
    If this produces any output, it may be possible to log into accounts
    with empty passwords.
