hardening: reject authentication with empty passwd

SSH defaults to disallowing empty passwords but Dovecot has no similar safeguard (at least not one enabled by default). Remove "nullok" from /etc/pam.d/system-auth to implement the desired behavior system-wide.

Applied to hcloud servers; will wait a couple of weeks to see if it has any unintended side-effect before merging and applying to the rest of the servers.

added 7 commits

• 7860af64...d4803179 - 6 commits from branch master
• 6b5a5eea - hardening: reject authentication with empty passwd

Compare with previous version

marked this merge request as ready

mentioned in commit 4124c3c1

merged