upvote
Where did you get that idea? The entire bug is about password hashing. With password auth off, that's not even attempted.
reply
The exploit works for a user account that has no password. This is often confused with turning off password auth, especially in containers that have only one usable account.

It's not just the parent commenter. I'm sure somebody out there is going to remove their account password instead of editing their sshd_config in an attempt to "patch" this vulnerability, actually exacerbating the problem.

reply
Bug > are password logins still on? they are by default

You > This particular bug works even with password authentication turned off.

No. The bug is related to password authentication. If you do not have password authentication then you are not affected.

What freaks some people out is they chose parameters where they do have password authentication but they expect to always fail. That's a bad choice, like OK you did fit a cheap manual keyhole, but you threw the keys away thinking now nobody can open that - you realise somebody with a cheap jiggler can open it right ?

reply
read the article again
reply
> This particular bug works even with password authentication turned off.

Does it ?

Somebody here has already said "You can set PasswordAuthentication=no or update to remediate"

We don't use musl at $work anyway, so I've no means to test.

reply