{"id":394142,"date":"2024-12-17T06:04:23","date_gmt":"2024-12-17T06:04:23","guid":{"rendered":"https:\/\/www.ninjaone.com\/?post_type=script_hub&p=394142"},"modified":"2024-12-17T06:04:23","modified_gmt":"2024-12-17T06:04:23","slug":"disabilitare-permitemptypasswords-in-linux","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/it\/script-hub\/disabilitare-permitemptypasswords-in-linux\/","title":{"rendered":"Disabilitare PermitEmptyPasswords con uno script Bash\u00a0per proteggere l’accesso SSH"},"content":{"rendered":"

Garantire un accesso sicuro ai server \u00e8 una priorit\u00e0 assoluta per i professionisti IT e i provider di servizi gestiti (MSP)<\/a>. Un aspetto importante della sicurezza dei server \u00e8 la gestione delle configurazioni SSH per evitare accessi non autorizzati. Una misura di sicurezza critica \u00e8 quella di disabilitare l’opzione PermitEmptyPasswords di OpenSSH, che impedisce agli utenti di accedere con una password vuota. In questo articolo presentiamo uno script Bash progettato per disabilitare PermitEmptyPasswords e garantire cos\u00ec una maggiore sicurezza ai sistemi Linux<\/a>.<\/p>\n

Contesto<\/h2>\n

OpenSSH \u00e8 un protocollo ampiamente utilizzato per la gestione sicura dei server remoti. Per impostazione predefinita, l’opzione PermitEmptyPasswords \u00e8 impostata su “no”, ma \u00e8 essenziale verificare e applicare questa configurazione per ridurre i rischi associati a configurazioni errate o non verificate. I professionisti IT che gestiscono pi\u00f9 sistemi potrebbero trascurare questo dettaglio, lasciando i server vulnerabili. Questo script fornisce una soluzione automatizzata che garantisce la conformit\u00e0 alle best practice disabilitando esplicitamente la possibilit\u00e0 di login con password vuote.<\/p>\n

Per gli MSP e gli amministratori che gestiscono numerosi server, questo script per disabilitare PermitEmptyPasswords semplifica l’hardening SSH, offrendo un modo rapido e affidabile per migliorare la sicurezza senza interventi manuali.<\/p>\n

Lo script per disabilitare PermitEmptyPasswords:<\/h2>\n
#!\/usr\/bin\/env bash\r\n\r\n# Description: Explicitly disables PermitEmptyPasswords in OpenSSH.\r\n# By using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n# Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n# Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n# Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n# Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n# Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n# Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n# EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#\r\n# PermitEmptyPasswords defaults to no when not specified in the sshd_config file.\r\n# This script will ensure that it is set to no to prevent SSH from accepting empty passwords.\r\n#\r\n# Links: https:\/\/man.openbsd.org\/sshd_config#PermitEmptyPasswords\r\n#\r\n# Release Notes: Initial Release\r\n\r\n# Logs an error message and exits with the specified exit code\r\ndie() {\r\n    local _ret=\"${2:-1}\"\r\n    echo \"$1\" >&2\r\n    exit \"${_ret}\"\r\n}\r\n\r\n# Check that we are running as root\r\nif [[ $EUID -ne 0 ]]; then\r\n    die \"[Error] This script must be run as root.\" 1\r\nfi\r\n\r\n_should_reload=\"false\"\r\n\r\n# Check if the sshd_config file exists\r\nif [[ -f \/etc\/ssh\/sshd_config ]]; then\r\n    # Check if the PermitEmptyPasswords option is already set to no\r\n    if grep -q \"^PermitEmptyPasswords no\" \/etc\/ssh\/sshd_config; then\r\n        echo \"[Info] PermitEmptyPasswords is already set to no.\"\r\n        _should_reload=\"false\"\r\n    elif grep -q \"^PermitEmptyPasswords yes\" \/etc\/ssh\/sshd_config; then\r\n        # First check if the option is not commented out and set to yes\r\n        # Then set the PermitEmptyPasswords option to no\r\n        sed -i 's\/^PermitEmptyPasswords.*\/PermitEmptyPasswords no\/' \/etc\/ssh\/sshd_config\r\n        echo \"[Info] PermitEmptyPasswords set to no.\"\r\n        _should_reload=\"true\"\r\n    elif grep -q \"^#PermitEmptyPasswords\" \/etc\/ssh\/sshd_config; then\r\n        # First check if the option is commented out\r\n        # Then set the PermitEmptyPasswords option to no\r\n        sed -i 's\/^#PermitEmptyPasswords.*\/PermitEmptyPasswords no\/' \/etc\/ssh\/sshd_config\r\n        echo \"[Info] PermitEmptyPasswords set to no, as it was commented out.\"\r\n        _should_reload=\"true\"\r\n    else\r\n        # Append the PermitEmptyPasswords option to the end of the sshd_config file\r\n        # If the past checks have not found the option, appending it will ensure that it is set to no\r\n        echo \"PermitEmptyPasswords no\" >>\/etc\/ssh\/sshd_config\r\n        echo \"[Info] PermitEmptyPasswords set to no at the end of the sshd_config file.\"\r\n        _should_reload=\"true\"\r\n    fi\r\n\r\n    # Check that this system is running systemd-based\r\n    _type=$(\r\n        # Get the type of init system\r\n        file \/sbin\/init 2>\/dev\/null | awk -F\/ '{print $NF}' 2>\/dev\/null\r\n    )\r\n    if [[ \"${_type}\" == \"systemd\" ]] && [ \"$(command -v systemctl)\" ]; then\r\n        echo \"[Info] Reloading ${sshd_service} service...\"\r\n        # Find the sshd service\r\n        sshd_service=$(\r\n            # Get the ssh service, if two are found use the first one. Likely the first one is a symlink to the actual service file.\r\n            systemctl list-unit-files | grep -E \"^(sshd|ssh|openssh-server)\\.service\" | awk -F' ' '{print $1}' | head -n 1\r\n        )\r\n        if [[ -z \"${sshd_service}\" ]]; then\r\n            die \"[Error] sshd service is not available. Please install it and try again.\" 1\r\n        fi\r\n        # Check that ssh service is enabled\r\n        if systemctl is-enabled \"${sshd_service}\" >\/dev\/null; then\r\n            echo \"[Info] ${sshd_service} is enabled.\"\r\n        else\r\n            die \"[Info] ${sshd_service} is not enabled. When enabled and started, PermitEmptyPasswords will be set to no.\" 0\r\n        fi\r\n        # Check that ssh service is running\r\n        if systemctl is-active \"${sshd_service}\" >\/dev\/null; then\r\n            echo \"[Info] ${sshd_service} is running.\"\r\n            if [[ \"${_should_reload}\" == \"true\" ]]; then\r\n                # Reload sshd.service\r\n                if systemctl reload \"${sshd_service}\"; then\r\n                    echo \"[Info] sshd service configuration reloaded.\"\r\n                else\r\n                    die \"[Error] Failed to reload ${sshd_service}. Please try again.\" 1\r\n                fi\r\n            else\r\n                echo \"[Info] sshd service configuration will not be reloaded as there is no need to do so.\"\r\n            fi\r\n        else\r\n            echo \"[Info] ${sshd_service} is not running.\"\r\n        fi\r\n    else\r\n        echo \"[Info] Restarting sshd service...\"\r\n        # Check that the service command is available\r\n        if ! [ \"$(command -v service)\" ]; then\r\n            die \"[Error] The service command is not available. Is this an initd type system (e.g. SysV)? Please try again.\" 1\r\n        fi\r\n        # Find the sshd service\r\n        sshd_service=$(\r\n            # Get the list of services\r\n            service --status-all | awk -F' ' '{print $NF}' | grep sshd\r\n        )\r\n        if [[ -z \"${sshd_service}\" ]]; then\r\n            die \"[Error] sshd service is not available. Please install it and try again.\" 1\r\n        fi\r\n        if [[ \"${_should_reload}\" == \"true\" ]]; then\r\n            # Restart sshd service\r\n            if service \"${sshd_service}\" restart; then\r\n                echo \"[Info] sshd service restarted.\"\r\n            else\r\n                die \"[Error] Failed to restart sshd service. Please try again.\" 1\r\n            fi\r\n        else\r\n            echo \"[Info] sshd service configuration will not be restarted as there is no need to do so.\"\r\n        fi\r\n    fi\r\nelse\r\n    die \"[Error] The sshd_config file does not exist.\" 1\r\nfi<\/pre>\n
 <\/p>\n\n
Risparmia tempo con gli oltre 300 script del Dojo NinjaOne.<\/p>\n
\u2192 Accedi oggi stesso<\/a>.<\/p>\n<\/div>\n
Analisi dettagliata<\/h2>\n
Questo script Bash automatizza il processo di impostazione esplicita di PermitEmptyPasswords su “no” nel file di configurazione SSH (\/etc\/ssh\/sshd_config). Di seguito viene illustrato passo per passo il funzionamento dello script per disabilitare PermitEmptyPasswords:<\/p>\n
1. Verifica dei privilegi di root<\/h3>\n
Lo script per disabilitare PermitEmptyPasswords inizia verificando se viene eseguito come utente root, poich\u00e9 la modifica delle configurazioni SSH richiede permessi elevati. In caso contrario, termina con un errore.<\/p>\n
bash<\/p>\n
Copia il codice<\/p>\n
if [[ $EUID -ne 0 ]]; then
\ndie “[Errore] Questo script deve essere eseguito come root” 1
\nfi<\/p>\n
2. Identificazione del file di configurazione<\/h3>\n
Lo script per disabilitare PermitEmptyPasswords verifica l’esistenza di \/etc\/ssh\/sshd_config. Se questo file manca, lo script esce con un errore, poich\u00e9 non pu\u00f2 procedere senza il file di configurazione SSH.<\/p>\n
3. Modifica dell’impostazione PermitEmptyPasswords<\/h3>\n
Lo script per disabilitare PermitEmptyPasswords ispeziona il file alla ricerca della direttiva PermitEmptyPasswords:<\/p>\n