UCF STIG Viewer Logo

The Ubuntu operating system must be configured so that the SSH daemon does not allow authentication using an empty password.


Overview

Finding ID Version Rule ID IA Controls Severity
V-75833 UBTU-16-030250 SV-90513r3_rule High
Description
Failure to restrict system access to authenticated users negatively impacts Ubuntu operating system security.
STIG Date
Canonical Ubuntu 16.04 Security Technical Implementation Guide 2020-05-29

Details

Check Text ( C-75521r2_chk )
To determine how the SSH daemon's "PermitEmptyPasswords" option is set, run the following command:

# grep -i PermitEmptyPasswords /etc/ssh/sshd_config
PermitEmptyPasswords no

If no line is returned, the line is commented out, or the value is set to "yes", this is a finding.
Fix Text (F-82463r3_fix)
To explicitly disallow remote logon from accounts with empty passwords, add or correct the following line in "/etc/ssh/sshd_config":

PermitEmptyPasswords no

Note: Any accounts with empty passwords should be disabled immediately, and PAM configuration should prevent users from being able to assign themselves empty passwords.

The SSH daemon must be restarted for the changes to take effect. To restart the SSH daemon, run the following command:

# sudo systemctl restart sshd.service