OpenVAPTSSH Permits Empty Passwords
Checks whether SSH lets accounts with an empty password log in.
- Why It Matters
- Any account without a password becomes an open door to anyone on the network.
- How It Detects
- Reads PermitEmptyPasswords from the effective sshd configuration; 'yes' fails. A risky value set inside a Match block in the config files fails as a conditional finding, with the Match condition in the evidence.
- How to Fix
- Set PermitEmptyPasswords no in /etc/ssh/sshd_config, reload sshd, and give every account a password or lock it (passwd -l <user>).
- How to Verify
sshd -T | grep -i permitemptypasswords should print 'no'.- CVSS v3.1 Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Control Category
- Identity and Authentication: CIS Controls v8 5, 6; NIST CSF 2.0 PR.AA
- Fix Effort
- Low
- CIS Controls v8 Safeguard
- 4.1
- NIST CSF 2.0 Subcategory
- PR.PS-01
- CWE
- CWE-258
- NIST SP 800-53 Rev. 5
- IA-5(1)
- Benchmark Topic
- SSH server configuration: empty passwords (topic only, no benchmark text)
- References
- OpenBSD, sshd_config(5) manual page
Source Code
The complete file that defines this check. Run it with openvapt scan --only HOST-SSH-003, or read it offline with openvapt explain HOST-SSH-003.
internal/checks/host/ssh_empty_passwords.go · Lines 1-39View on GitHub at This Commit
| 1 | package host |
| 2 | |
| 3 | import ( |
| 4 | "context" |
| 5 | |
| 6 | "github.com/openvapt/openvapt/internal/check" |
| 7 | "github.com/openvapt/openvapt/internal/checks/collect" |
| 8 | "github.com/openvapt/openvapt/internal/sys" |
| 9 | ) |
| 10 | |
| 11 | func init() { |
| 12 | check.Register(&check.Check{ |
| 13 | ID: "HOST-SSH-003", |
| 14 | Title: "SSH Permits Empty Passwords", |
| 15 | Domain: check.DomainHost, |
| 16 | Severity: check.Critical, |
| 17 | CVSS: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", |
| 18 | Summary: "Checks whether SSH lets accounts with an empty password log in.", |
| 19 | Rationale: "Any account without a password becomes an open door to anyone on the network.", |
| 20 | Detection: "Reads PermitEmptyPasswords from the effective sshd configuration; 'yes' fails. A risky value set inside a Match block in the config files fails as a conditional finding, with the Match condition in the evidence.", |
| 21 | Fix: "Set PermitEmptyPasswords no in /etc/ssh/sshd_config, reload sshd, and give every account a password or lock it (passwd -l <user>).", |
| 22 | Verify: "sshd -T | grep -i permitemptypasswords should print 'no'.", |
| 23 | Refs: []check.Ref{refSSHDManual}, |
| 24 | Standards: check.Standards{CWE: []string{"CWE-258"}, NIST: []string{"IA-5(1)"}, CISTopic: "SSH server configuration: empty passwords"}, |
| 25 | Run: func(ctx context.Context, s sys.System) []check.Result { |
| 26 | cfg, ok := collect.SSHD(ctx, s) |
| 27 | if !ok { |
| 28 | return []check.Result{check.SkipR("sshd", "SSH daemon configuration not found")} |
| 29 | } |
| 30 | if cfg["permitemptypasswords"] == "yes" { |
| 31 | return []check.Result{check.FailR("sshd", "Empty passwords are accepted", "permitemptypasswords yes")} |
| 32 | } |
| 33 | if r, bad := sshMatchFail(cfg, "Empty passwords are accepted", "permitemptypasswords"); bad { |
| 34 | return []check.Result{r} |
| 35 | } |
| 36 | return []check.Result{check.PassR("sshd", "Empty passwords are refused")} |
| 37 | }, |
| 38 | }) |
| 39 | } |
Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.
Cite This Page
If this page helped your work, please cite it. The version and web address are filled in; the access date is today's date in your browser. Every other style, and when credit is required, is on How to Cite OpenVAPT.
OpenVAPT. (2026). HOST-SSH-003 SSH Permits Empty Passwords (Version 0.1.0-alpha.6). OpenVAPT Check Catalogue. Retrieved October 16, 2026, from https://openvapt.com/checks/HOST-SSH-003.html
In text: (OpenVAPT, 2026). Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.
@misc{openvapt_host_ssh_003,
author = {{OpenVAPT}},
title = {{HOST-SSH-003 SSH Permits Empty Passwords}},
year = {2026},
howpublished = {\url{https://openvapt.com/checks/HOST-SSH-003.html}},
note = {OpenVAPT Check Catalogue, version 0.1.0-alpha.6. Accessed 16 October 2026}
}
Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.
Citing OpenVAPT does not mean OpenVAPT endorses, approves or has reviewed your work.