STIGQter: STIG Summary: Microsoft Windows Server 2025 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

Windows Server 2025 OpenSSH must not allow blank passwords.

DISA Rule

SV-285316r1211176_rule

Vulnerability Number

V-285316

Group Title

SRG-OS-000106-GPOS-00053

Rule Version

WN25-SH-000040

Severity

CAT I

CCI(s)

• CCI-000766 - Implement multifactor authentication for network access to non-privileged accounts.

Weight

10

Fix Recommendation

To configure the system, add or modify the following line in the "$env:ProgramData/ssh/sshd_config" file:

PermitEmptyPasswords no

Restart the OpenSSH service for the settings to take effect.

Check Contents

If OpenSSH is not installed on the system, this requirement is not applicable.

Verify system remote access using OpenSSH prevents logging on with a blank password with the following command:

C:\ > Get-Content "$env:ProgramData\ssh\sshd_config" | Select-String -Pattern '^\s*PermitEmptyPasswords'

PermitEmptyPasswords no

If the "PermitEmptyPasswords" keyword is set to "yes", is missing, or is commented out, this is a finding.

Vulnerability Number

V-285316

Documentable

False

Rule Version

WN25-SH-000040

Severity Override Guidance

If OpenSSH is not installed on the system, this requirement is not applicable.

Verify system remote access using OpenSSH prevents logging on with a blank password with the following command:

C:\ > Get-Content "$env:ProgramData\ssh\sshd_config" | Select-String -Pattern '^\s*PermitEmptyPasswords'

PermitEmptyPasswords no

If the "PermitEmptyPasswords" keyword is set to "yes", is missing, or is commented out, this is a finding.

Check Content Reference

M

Target Key

5719