The Photon operating system must not allow empty passwords.

Accounts with empty or no passwords allow anyone to log on as that account without specifying a password or other forms of authentication. Allowing accounts with empty passwords puts the system at significant risk since only the username is required for access.

At the command line, run the following command to verify empty passwords are not allowed:

# grep nullok /etc/pam.d/system-password /etc/pam.d/system-auth

If any results are returned indicating "nullok" is configured on the "pam_unix.so" module, this is a finding.

Navigate to and open:

/etc/pam.d/system-password or /etc/pam.d/system-auth

Remove the "nullok" argument on the "pam_unix.so" module line.

Note: On vCenter appliances, the equivalent file must be edited under "/etc/applmgmt/appliance", if one exists, for the changes to persist after a reboot.