Rule ID
SV-266063r1003661_rule
Version
V2R2
CCIs
Accounts with empty or no passwords allow anyone to log on as that account without specifying a password or other forms of authentication. Allowing accounts with empty passwords puts the system at significant risk since only the username is required for access.
At the command line, run the following command to verify empty passwords are not allowed: # grep nullok /etc/pam.d/system-password /etc/pam.d/system-auth If any results are returned indicating "nullok" is configured on the "pam_unix.so" module, this is a finding.
Navigate to and open: /etc/pam.d/system-password or /etc/pam.d/system-auth Remove the "nullok" argument on the "pam_unix.so" module line. Note: On vCenter appliances, the equivalent file must be edited under "/etc/applmgmt/appliance", if one exists, for the changes to persist after a reboot.