HIGH RHCOS (Node) H3: SSHD Empty Passwords P1

PASS (vanilla RHCOS 9.8+) Scanned: 2026-08-12 Synced: 2026-06-30

PermitEmptyPasswords is already set to 'no' by default in RHCOS 10.2 (OCP 5.0). No MachineConfig needed. OCP 4.22 and earlier still require remediation.

No remediation needed on RHCOS 10.2+ (OCP 5.0+). These checks PASS on vanilla RHCOS 10.2 due to hardened OS defaults shipped in that version. Older RHCOS versions (9.6 and earlier) still require remediation. Verified with compliance-operator v1.8.2 and pinned content quay.io/bapalm/k8scontent:v0.1.80.

Overview

This remediation configures the SSH daemon to explicitly deny authentication with empty passwords. This is a HIGH severity compliance requirement.

Settings

Setting	Value	Description
`PermitEmptyPasswords`	`no`	Prevent SSH login with empty passwords

Implementation

The remediation applies a MachineConfig with SSHD hardening:

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  name: 75-sshd-hardening
  labels:
    machineconfiguration.openshift.io/role: master
spec:
  config:
    ignition:
      version: 3.2.0
    storage:
      files:
        - path: /etc/ssh/sshd_config.d/75-hardening.conf
          mode: 0600
          overwrite: true
          contents:
            inline: |
              # HIGH severity - Disable empty passwords
              PermitEmptyPasswords no

Compliance Checks Remediated

This group addresses the following compliance checks:

Check	Profile	Description	Docs
`rhcos4-e8-worker-sshd-disable-empty-passwords`	E8	Disable SSH empty passwords (worker)	📖
`rhcos4-e8-master-sshd-disable-empty-passwords`	E8	Disable SSH empty passwords (master)	📖

Source Remediation Files

high/rhcos4-e8-worker-sshd-disable-empty-passwords.yaml
high/rhcos4-e8-master-sshd-disable-empty-passwords.yaml

Verification

After applying the MachineConfig, verify SSHD configuration:

oc debug node/<node-name> -- chroot /host sshd -T | grep permitemptypasswords
# Expected output: permitemptypasswords no

Security Impact

Disabling empty passwords ensures that:

All SSH connections require proper password or key authentication
Accounts without passwords cannot be accessed remotely
Compliance with Essential Eight and CIS benchmarks

Other SSHD hardening groups (to be addressed separately):

M1: SSHD Configuration - MEDIUM severity SSHD settings
L1: SSHD LogLevel - LOW severity SSHD setting

← H2 All Groups M1 →