TMA-ROS1-5.2.11

Ensure SSH PermitEmptyPasswords is disabled

VisokaNivo 1Automatskaros

Opis

The PermitEmptyPasswords parameter specifies if the SSH server allows login to accounts with empty password strings. The audit requires PermitEmptyPasswords no. The audit reads the effective sshd configuration (sshd -T, root). Host-level control from the CIS ROS Melodic benchmark (Ubuntu 18.04 robot hosts); run as root.

Kako se proverava

Metod provere: Komanda ljuske

shell

command -v sshd >/dev/null 2>&1 || exit 1
out=$(sshd -T -C user=root -C host="$(hostname)" -C addr="$(hostname -I 2>/dev/null | cut -d' ' -f1)" 2>/dev/null) || out=$(sshd -T 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk 'tolower($1)=="permitemptypasswords"{print tolower($2); exit}')
case "$v" in no) echo compliant ;; *) echo "PermitEmptyPasswords ${v:-unset}" ;; esac

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Edit the /etc/ssh/sshd_config file to set the parameter as follows: PermitEmptyPasswords no

Svojstva

Operativni sistemi: Bilo koji
Oznake: rosros1melodicaccess-control
Referenca: CIS ROS Melodic Benchmark v1.0.0 - 5.2.11 Ensure SSH PermitEmptyPasswords is disabled

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target ros