TMA-ROS1-5.2.11

Ensure SSH PermitEmptyPasswords is disabled

TinggiLevel 1Otomatisros

Deskripsi

The PermitEmptyPasswords parameter specifies if the SSH server allows login to accounts with empty password strings. The audit requires PermitEmptyPasswords no. The audit reads the effective sshd configuration (sshd -T, root). Host-level control from the CIS ROS Melodic benchmark (Ubuntu 18.04 robot hosts); run as root.

Cara pemeriksaan

Metode audit: Perintah shell

shell

command -v sshd >/dev/null 2>&1 || exit 1
out=$(sshd -T -C user=root -C host="$(hostname)" -C addr="$(hostname -I 2>/dev/null | cut -d' ' -f1)" 2>/dev/null) || out=$(sshd -T 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk 'tolower($1)=="permitemptypasswords"{print tolower($2); exit}')
case "$v" in no) echo compliant ;; *) echo "PermitEmptyPasswords ${v:-unset}" ;; esac

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Edit the /etc/ssh/sshd_config file to set the parameter as follows: PermitEmptyPasswords no

Properti

Sistem operasi: Apa saja
Tag: rosros1melodicaccess-control
Referensi: CIS ROS Melodic Benchmark v1.0.0 - 5.2.11 Ensure SSH PermitEmptyPasswords is disabled

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target ros