Red Hat Enterprise Linux 9 Security Technical Implementation Guide

The Red Hat Enterprise Linux 9 Security Technical Implementation Guide (V2 R10) has 445 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

445STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R10

CurrentPublished Wed Sep 30 2026

RHEL 9 SSHD must not allow blank passwords.

Red Hat Enterprise Linux 9 Security Technical Implementation Guide

Assessment Title

Rule Text

RHEL 9 SSHD must not allow blank passwords.

Description

Discussion Text

If an account has an empty password, anyone could log on and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.

Satisfies: SRG-OS-000106-GPOS-00053, SRG-OS-000480-GPOS-00229, SRG-OS-000480-GPOS-00227

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-257984

Rule

SV-257984r1268229_rule

Severity

high

Rule Version

RHEL-09-255040

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify that RHEL 9 remote access using SSH prevents logging on with a blank password with the following command:

$ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*permitemptypasswords'

PermitEmptyPasswords no

If the "PermitEmptyPasswords" keyword is set to "yes", is missing, or is commented out, this is a finding.

Implementation Procedure

Fix Text

To configure the system to prevent SSH users from logging on with blank passwords edit the following line in "/etc/ssh/sshd_config" or in a file in "/etc/ssh/sshd_config.d":

PermitEmptyPasswords no

Restart the SSH daemon for the settings to take effect:

$ sudo systemctl restart sshd.service

STIG check 201 of 445 in the Red Hat Enterprise Linux 9 STIG checklist

← Previous · V-257983RHEL 9 SSHD must accept public key authentication.Next · V-257985 →RHEL 9 must not permit direct logons to the root account using remote access via SSH.