TMA-AIX-4.6.3.13

Ensure sshd PermitEmptyPasswords is disabled

嚴重等級 1自動化aix

說明

The recommendation is to edit the /etc/ssh/sshd_config file to ensure that the SSH daemon does not authenticate users with a null password. If password authentication is used and an account has an empty password, the SSH server must be configured to disallow access to the account. Permitting empty passwords could create an easy path of access for hackers to enter the system. Audit: evaluates the effective configuration from `sshd -T` (Match blocks must be reviewed separately).

檢查方式

稽核方法: Shell 指令

shell

command -v sshd >/dev/null 2>&1 || exit 1; out=$(sshd -T 2>/dev/null) || exit 1; r=compliant; for p in '^permitemptypasswords[[:blank:]]+no$'; do printf '%s\n' "$out" | grep -Eiq -- "$p" || r="not matched: $p"; done; echo "$r"

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Edit the /etc/ssh/sshd_config file to disable the acceptance null passwords: vi /etc/ssh/sshd_config Replace: #PermitEmptyPasswords no With: PermitEmptyPasswords no Re-cycle the sshd daemon to pick up the configuration changes: stopsrc -s sshd startsrc -s sshd

屬性

作業系統: 不限
標籤: aixssh
參考資料: CIS IBM AIX 7 Benchmark v1.2.0 - 4.6.3.13 Ensure sshd PermitEmptyPasswords is disabled

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target aix