In unix-like systems, is there an anonymous login and how to disable it?

Question

I am a DevOps engineer working with AWS. My company is under a security audit and we got a report stating the following points:

--- REPORT BEGIN ---

Observation: In some EC2 instances, anonymous logins are allowed which in turn allows users with root privileges to login without a password.

Consequences: It can grant non-authorized access to the console which might cause privilege scalation or issues with data confidentiality.

Recommendation: To always ask password when logging in and also when executing root commands.

Action: Implement .pem certificates and disable anonymous login for the given ec2 list.

--- REPORT END ---

All instances listed in their report have already these mitigations in place:

• To SSH to them you need a .pem file
• You cannot SSH to them with the root user (you must login with another user e.g. centos, ubuntu)
• Once you are connected to an instance with a user that can executes root commands, if you try to execute a root command you have to type the user's password.
• There were around 27 instances reported. Almost all of them have Ubuntu or CentOS.

So having said that, my questions are...

• What am I missing to meet the audit requirements?
• What would they mean by anonymous login?
• How to disable whatever this "anonymous login" is?

My only idea as of now is to ask for both KeyAuthentication and PasswordAuthentication when SSH, but not sure if that would help or hurt.

Answer 1

An audit "report" without context is about 100% useless

Presuming what you've shared is all that is relevant from the report, there is no context

You need to get full context for each of the claimed "findings" in the report

They may be correct...they may not

But as stated herein, there is nothing you can do to answer them if you've already disabled direct root login, and are using key-based authentication only