# Ensure sshd PermitEmptyPasswords is disabled

Necessity: Allowing empty passwords for SSH authentication is a critical security vulnerability. It permits any user with a null password on the system to log in remotely, completely bypassing password-based security controls. This creates a trivial entry point for attackers to gain unauthorized access, especially if a system or service account is inadvertently configured without a password. Disabling this setting is a fundamental security measure to enforce strong authentication and prevent unauthorized access. The risk of leaving this enabled is a complete system compromise. Auditing and Remediation: The audit script directly queries the running SSH daemon's configuration to verify the effective state of the 'PermitEmptyPasswords' parameter, ensuring an accurate reading. The remediation script directly edits the '/etc/ssh/sshd_config' file to enforce the 'no' setting, creating the line if it's missing or modifying it if it exists, and then reloads the SSH service to activate the new configuration. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'no'. This is a binary security control with no room for permissive exceptions in any secure environment. Enabling it ('yes') is insecure, while disabling it ('no') is the only secure option. Therefore, all hardening levels mandate that this feature be disabled to ensure that only accounts with non-empty passwords can be used for SSH authentication, aligning with universal security best practices and compliance standards like CIS Benchmarks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['no']` |
| **Moderate** | `['no']` |
| **Strict** | `['no']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the effective SSH server configuration for the 'PermitEmptyPasswords' setting using the command `sshd -T | grep -i '^permitemptypasswords' | awk '{print $2}'`. The script must be designed to output only the current value (e.g., 'no' or 'yes') with no additional text or formatting.

## Remediation Script Working

Bash script that modifies the 'PermitEmptyPasswords' setting in the '/etc/ssh/sshd_config' file. The script must accept the desired state (e.g., 'no') as a single positional command-line argument. The script should find and replace the existing value, uncomment and set the value if it's commented out, or add the setting if it does not exist. After modifying the file, the script must reload or restart the SSH service to apply the change and then output 'true' for success or 'false' for failure.

