Disabling SSH sign-in for accounts with empty passwords

Question

How to prevent sign-in over SSH for accounts that have an empty password?

Answer

With the setting PermitEmptyPasswords yes, SSH lets an account that has an empty password sign in with no password at all. Any person who knows the name of such an account can get a shell on the server. To prevent this, set PermitEmptyPasswords no. This is the default value of OpenSSH.

Note: After this change, accounts with an empty password cannot sign in over SSH with a password. If such an account needs SSH access, set a password for it or set up SSH key sign-in for it first.

1. Connect to the Plesk server via SSH.

2. Create a backup copy of the SSH server configuration file. If the value is also set in an included file, create a backup copy of that file in the same way:

   # cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

3. Set PermitEmptyPasswords no in the SSH server configuration. The value can be in the /etc/ssh/sshd_config file or in a file that sshd_config includes, for example a file in the /etc/ssh/sshd_config.d/ directory. Change the value in each file where it is set. Also change it in each Match block that sets PermitEmptyPasswords yes. To edit the file, use any text editor.

4. Check the configuration for errors:

   # sshd -t

   Note: On Debian and Ubuntu, this command can show "Missing privilege separation directory: /run/sshd". In this case, create the directory with mkdir -p /run/sshd and run the command again.

5. Restart the SSH service.

   For Plesk on CentOS / AlmaLinux / CloudLinux / RHEL:

   # systemctl restart sshd

   For Plesk on Debian / Ubuntu:

   # systemctl restart ssh

6. Check the value that SSH uses:

   # sshd -T

   In the output, the line permitemptypasswords must show no. If it shows yes, find the file that still sets yes, and go back to step 3.