HighSSHBLWK-SSH-001

SSH password authentication is enabled

What this means

PasswordAuthentication is set to “‹password authentication›” in sshd_config, which allows an attacker to brute-force their way in with a password guess instead of needing a private key. It is the OpenSSH default and a brute-force exposure rather than a definite compromise, so it's rated high (aligning with CIS's L1 treatment and with BLWK-SSH-002), not critical.

How to fix it

Set PasswordAuthentication no in /etc/ssh/sshd_config and run systemctl restart sshd. IMPORTANT: confirm key-based login works in a SECOND session before you rely on this — if the only working credential is a password and no key is installed, you will lock yourself out on the next login. Existing sessions survive the restart; a new key-authenticated login must succeed first.

Check it yourself

Run a scan and look for BLWK-SSH-001 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads sshd_config and reports this check when:

password_authentication == "yes"

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• CIS Benchmark 5.2.10
• MITRE ATT&CK T1110

Related checks

• SSH root login is permitted · BLWK-SSH-002
• SSH allows empty passwords · BLWK-SSH-003
• SSH X11 forwarding is enabled · BLWK-SSH-004
• SSH TCP forwarding/tunneling is enabled · BLWK-SSH-005
• SSH permits user-set environment variables · BLWK-SSH-006
• SSH tun-device (layer 2/3) tunneling is enabled · BLWK-SSH-007