TMA-AIX-4.6.3.13
Ensure sshd PermitEmptyPasswords is disabled
Description
The recommendation is to edit the /etc/ssh/sshd_config file to ensure that the SSH daemon does not authenticate users with a null password. If password authentication is used and an account has an empty password, the SSH server must be configured to disallow access to the account. Permitting empty passwords could create an easy path of access for hackers to enter the system. Audit: evaluates the effective configuration from `sshd -T` (Match blocks must be reviewed separately).
How it is checked
Audit method: Shell command
command -v sshd >/dev/null 2>&1 || exit 1; out=$(sshd -T 2>/dev/null) || exit 1; r=compliant; for p in '^permitemptypasswords[[:blank:]]+no$'; do printf '%s\n' "$out" | grep -Eiq -- "$p" || r="not matched: $p"; done; echo "$r"- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Edit the /etc/ssh/sshd_config file to disable the acceptance null passwords: vi /etc/ssh/sshd_config Replace: #PermitEmptyPasswords no With: PermitEmptyPasswords no Re-cycle the sshd daemon to pick up the configuration changes: stopsrc -s sshd startsrc -s sshd
Properties
- Operating systems
- Any
- Tags
- aixssh
- Reference
- CIS IBM AIX 7 Benchmark v1.2.0 - 4.6.3.13 Ensure sshd PermitEmptyPasswords is disabled
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target aix