Comment by sjamaan
2 days ago
Where did you get that idea? The entire bug is about password hashing. With password auth off, that's not even attempted.
2 days ago
Where did you get that idea? The entire bug is about password hashing. With password auth off, that's not even attempted.
The exploit works for a user account that has no password. This is often confused with turning off password auth, especially in containers that have only one usable account.
It's not just the parent commenter. I'm sure somebody out there is going to remove their account password instead of editing their sshd_config in an attempt to "patch" this vulnerability, actually exacerbating the problem.