Comment by bombcar
2 days ago
Alpine matches the first.
Disabling PAM has been "generally good security advice" for decades; I remember suggestions to not use it in the 2000s.
Password logins are often enabled, especially on multi-user and default setups.
If alpine uses the * feature, it's going to be pretty common. Gentoo has it, as does Ubuntu.
If password logins are enabled, you're almost guaranteed to have at least one user with a password (root on all my boxes has one, even if I never use it and it's random garbage).
So the cheese lines up pretty well, this affects quite a bit.
If password logins are enabled, someone almost certainly has a password.
So it's essentially one of the 'recommended configurations'?
I'm seeing people I generally trust in the scene memeing on twitter, while others are freaking out. Its hard for me to tell how fucked we are, I guess
It's always 50/50, you're either fucked or you ain't.
I think this time around it's mainly Alpine Linux and a few custom-rollers (Gentoo with musl could easily get to this place).
Yeah, as the dust starts to settle a bit it seems this is the largest case. Many 'stock' Alpine images, Docker images built on those, and embedded systems seem to be the main candidates.
Which distro has password authentication enabled by default? I haven’t seen that in years.