documentation_complete: true

title: 'Disable SSH Access via Empty Passwords'

description: |-
    To explicitly disallow remote login from accounts with
    empty passwords, add or correct the following line in
    <tt>/etc/ssh/sshd_config</tt>:
    <pre>PermitEmptyPasswords no</pre>
    Any accounts with empty passwords should be disabled immediately, and PAM configuration
    should prevent users from being able to assign themselves empty passwords.

rationale: |-
    Configuring this setting for the SSH daemon provides additional assurance that
    remote login via SSH will require a password,
    even in the event of misconfiguration elsewhere.

severity: high

identifiers:
    cce: 26887-0

references:
    disa: 765,766
    nist: AC-3
    srg: SRG-OS-000106
    stigid: RHEL-06-000239

ocil: '<sshd-check-macro default="yes" option="PermitEmptyPasswords" value="no" />'
