documentation_complete: true

title: 'Disable SSH Access via Empty Passwords'

description: |-
    To explicitly disallow SSH login from accounts with
    empty passwords, add or correct the following line in <tt>/etc/ssh/sshd_config</tt>:
    <br />
    <pre>PermitEmptyPasswords no</pre>
    <br />
    Any accounts with empty passwords should be disabled immediately, and PAM configuration
    should prevent users from being able to assign themselves empty passwords.

rationale: "Configuring this setting for the SSH daemon provides additional assurance that\nremote login via SSH will require a password, even in the event of \nmisconfiguration elsewhere."

severity: high

identifiers:
    cce@rhel7: 27471-2

references:
    cis: 5.2.9
    cjis: 5.5.6
    cui: 3.1.1,3.1.5
    disa: 366
    hipaa: 164.308(a)(4)(i),164.308(b)(1),164.308(b)(3),164.310(b),164.312(e)(1),164.312(e)(2)(ii)
    nist: AC-3,AC-6,CM-6(b)
    ospp@rhel7: FIA_AFL.1
    srg: SRG-OS-000480-GPOS-00229
    stigid@rhel7: "010300"

ocil: '<sshd-check-macro default="yes" option="PermitEmptyPasswords" value="no" />'
