cis-ubuntu1604-v200-5-3-12

name	cis-ubuntu1604-v200-5-3-12
description	Ensure SSH PermitEmptyPasswords is disabled
category	cis-networking
version	2.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-16.04","ssh","remote-access"]
cis_id	5.3.12
cis_benchmark	CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0 - Control 5.3.12

Description

The PermitEmptyPasswords parameter specifies if the SSH server allows login to accounts with empty password strings.

Rationale

Disallowing remote shell access to accounts that have an empty password reduces the probability of unauthorized access to the system.

Audit Procedure

Command Line

Run the following command and verify that output matches:

sshd -T -C user=root -C host="$(hostname)" -C addr="$(grep $(hostname) /etc/hosts | awk '{print $1}')" | grep permitemptypasswords

Expected Result

permitemptypasswords no

Run the following command and verify the output:

grep -Ei '^\s*PermitEmptyPasswords\s+yes' /etc/ssh/sshd_config

Nothing should be returned.

Remediation

Command Line

Edit the /etc/ssh/sshd_config file to set the parameter as follows:

PermitEmptyPasswords no

Default Value

PermitEmptyPasswords no

References

1. SSHD_CONFIG(5)

CIS Controls

Version 7

16.3 Require Multi-factor Authentication - Require multi-factor authentication for all user accounts, on all systems, whether managed onsite or by a third-party provider.

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Assessment Status

Automated