Ensure sshd PermitEmptyPasswords is disabled

檢查方式

稽核方法: Shell 指令

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; command -v sshd >/dev/null 2>&1 || { echo "step1: sshd not installed"; return 1; }; o=$(bash -c 'sshd -T | grep permitemptypasswords' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'permitemptypasswords no' || { echo step1: missing 'permitemptypasswords no'; return 1; }; }; if alt0; then echo compliant; fi

預期輸出

compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Edit /etc/ssh/sshd_config and set the PermitEmptyPasswords parameter to no above any Include and Match entries as follows: PermitEmptyPasswords no Note: First occurrence of an option takes precedence, Match set statements withstanding. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location. The SSH daemon must be restarted for the changes to take effect. To restart the SSH daemon, run the following command: # systemctl reload-or-restart sshd.service

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

tmaegis scan --target linux