4 ms·

'The affected SSHD configuration has the PermitEmptyPasswords option set to "yes".' Wow.

• spydum 8y ago
  Honestly this not that odd. If you have local users with no password (not normal), and ssh exposed, you prob have bigger issues. Do agree tho, this is a stupid default and surprising it got past any sort of system hardening checklist.
  • sydney6 8y ago
    iirc, OpenWRT also uses password-less root access via ssh by default and indeed, one might find these kind of configs in provisioning setups quite often. What are the options these days besides default user/pw? The (Plastic)Router from my ISP has this sticker on the back with a custom default pw for user access. Always wondered how this works.. probably somehow derived from MAC addresses and/or other factors.
    • pwnna 8y ago
      The last time I checked the password-less root is on first setup with telnet, accessible only via LAN and with WIFI off. The first thing it asks you to do is to set a password, before enabling SSH.