Ensure sshd PermitEmptyPasswords is disabled

How it is checked

Audit method: Shell command

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; command -v sshd >/dev/null 2>&1 || { echo "step1: sshd not installed"; return 1; }; o=$(bash -c 'sshd -T | grep permitemptypasswords' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'permitemptypasswords no' || { echo step1: missing 'permitemptypasswords no'; return 1; }; }; if alt0; then echo compliant; fi

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Edit /etc/ssh/sshd_config and set the PermitEmptyPasswords parameter to no above any Include and Match entries as follows: PermitEmptyPasswords no Note: First occurrence of an option takes precedence, Match set statements withstanding. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location. The SSH daemon must be restarted for the changes to take effect. To restart the SSH daemon, run the following command: # systemctl reload-or-restart sshd.service

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target linux