documentation_complete: true

prodtype: rhel7,fedora,ol7

title: 'Prevent Log In to Accounts With Empty Password'

description: |-
    If an account is configured for password authentication
    but does not have an assigned password, it may be possible to log
    into the account without authentication. Remove any instances of the <tt>nullok</tt>
    option in <tt>/etc/pam.d/system-auth</tt> to
    prevent logins with empty passwords.

rationale: |-
    If an account has an empty password, anyone could log in and
    run commands with the privileges of that account. Accounts with
    empty passwords should never be used in operational environments.

severity: high

identifiers:
    cce@rhel7: 27286-4

references:
    cjis: 5.5.2
    cui: '3.1.1, 3.1.5'
    disa: 366
    hipaa: 164.308(a)(1)(ii)(B),164.308(a)(7)(i),164.308(a)(7)(ii)(A),164.310(a)(1),164.310(a)(2)(i),164.310(a)(2)(ii),164.310(a)(2)(iii),164.310(b),164.310(c),164.310(d)(1),164.310(d)(2)(iii)
    nist: AC-6,IA-5(b),IA-5(c),IA-5(1)(a)
    ospp@rhel7: FIA_AFL.1
    pcidss: Req-8.2.3
    srg: SRG-OS-000480-GPOS-00227
    stigid@rhel7: "010290"

ocil_clause: 'NULL passwords can be used'

ocil: |-
    To verify that null passwords cannot be used, run the following command:
    <pre>$ grep nullok /etc/pam.d/system-auth</pre>
    If this produces any output, it may be possible to log into accounts
    with empty passwords. Remove any instances of the <tt>nullok</tt> option to
    prevent logins with empty passwords.
