documentation_complete: true

title: 'Log In to Accounts With Empty Password Impossible'

description: |-
    If an account is configured for password authentication but does not have an assigned password, it may be possible to log into the account without authentication.
    Remove any instances of the <tt>nullok</tt> option in <tt>/etc/pam.d/system-auth</tt> to prevent logins with empty passwords.

rationale: |-
    If an account has an empty password, anyone could log in and run commands with the privileges of that account.
    Accounts with empty passwords should never be used in operational environments.
    <br />
    Note that if the output includes <tt>nullok-secure</tt> but not <tt>nullok</tt>, then the vulnerability is limited to the specified set of terminals listed in <tt>/etc/securetty</tt>.

severity: high

references:
    nist: IA-5(b),IA-5(c),IA-5(1)(a)

ocil_clause: 'NULL passwords can be used'

ocil: |-
    To verify that null passwords cannot be used, run the following command:
    <pre># grep nullok /etc/pam.d/common-auth</pre>
    If this produces any output, it may be possible to log into accounts with empty passwords.
