If "PermitEmptyPasswords" and "PermitUserEnvironment" are not set to "no", are commented out, are missing, or conflicting results are returned, this is a finding.
Fix
Configure the SSH server to not allow unattended or automatic login to the system.
Add or modify the following lines in the "/etc/ssh/sshd_config" file:
PermitEmptyPasswords no PermitUserEnvironment no
Restart the SSH daemon for the changes to take effect: