Ensure sshd PermitEmptyPasswords is disabled

CriticalLevel 1Automatedfreebsd

Description

The PermitEmptyPasswords parameter specifies if the SSH server allows login to accounts with empty password strings. Disallowing remote shell access to accounts that have an empty password reduces the probability of unauthorized access to the system. Audit: evaluates the effective configuration from `sshd -T` (Match blocks must be reviewed separately).

How it is checked

Audit method: Shell command

shell

command -v sshd >/dev/null 2>&1 || exit 1; out=$(sshd -T 2>/dev/null) || exit 1; r=compliant; for p in '^permitemptypasswords[[:blank:]]+no$'; do printf '%s\n' "$out" | grep -Eiq -- "$p" || r="not matched: $p"; done; echo "$r"

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Edit the /etc/ssh/sshd_config file to set the parameter above any Include entries as follows: PermitEmptyPasswords no

Properties

Operating systems: Any
Tags: freebsdssh
Reference: CIS FreeBSD 14 Benchmark v1.0.1 - 4.2.18 Ensure sshd PermitEmptyPasswords is disabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target freebsd