# Ensure sshd PermitEmptyPasswords is disabled

Necessity: The 'PermitEmptyPasswords' setting determines whether the SSH server allows login to accounts with empty password strings. Enabling this setting is a critical security vulnerability, as it allows attackers to gain unauthorized access to any account that has a blank password, completely bypassing authentication controls. This misconfiguration exposes the system to trivial compromise.

Auditing and Remediation: The audit script directly queries the running SSH daemon's configuration to verify the effective state of the 'PermitEmptyPasswords' parameter, ensuring an accurate reading of the applied policy. The remediation script modifies the primary SSH configuration file, '/etc/ssh/sshd_config', to explicitly set the directive to 'no', then restarts the service to enforce the secure setting.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is 'no'. There is no security context in which allowing empty passwords for SSH authentication is acceptable. This is a fundamental security best practice and a requirement in nearly all security benchmarks, including CIS. The risk is binary and severe; therefore, the only appropriate configuration is to disable it, regardless of the desired hardening level.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['no']` |
| **Moderate** | `['no']` |
| **Strict** | `['no']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that executes the command `sudo sshd -T | grep -i '^permitemptypasswords' | awk '{print $2}'`. The script must output only the current value (e.g., 'no') and nothing else.

## Remediation Script Working

Bash script that accepts a single positional command-line argument (e.g., 'no'). The script must use this argument to set the 'PermitEmptyPasswords' value in the '/etc/ssh/sshd_config' file, creating the line if it does not exist or modifying it if it does. After updating the configuration, the script must restart the sshd service to apply the change. It must return 'true' on success and 'false' on failure.

