Comment on Update all your stuff, NOW - again.
Yep
NO! Exactly the opposite, that is the problem. Key-only is a prerequisite for this.
The “are you affected?” section directly contradicts this. It outright states you must have password authentication enabled. Otherwise, SSH never gives you a chance to even attempt a password.
Bottom of the page says what to do and gives 2 options to mitigate:
# update. openssh 10.6p2 fixes it. $ apk upgrade openssh # can't update yet? turn password logins off. $ echo "PasswordAuthentication no" > /etc/ssh/sshd_config.d/00-no-passwords.conf $ rc-service sshd restart
So if you disable password auth and only allow key auth, then you are unaffected (safe).
The introis a bit confusing but it means that if you have password auth on - then even if your regular ssh login requires a key, you are not safe.
Ah. Thanks for the correction. The intro + where I originally learned this from made me overreact a bit, it seems.
smiletolerantly@awful.systems 5 days ago
NO! Exactly the opposite, that is the problem. Key-only is a prerequisite for this.
AHemlocksLie@lemmy.zip 5 days ago
The “are you affected?” section directly contradicts this. It outright states you must have password authentication enabled. Otherwise, SSH never gives you a chance to even attempt a password.
HelloRoot@lemy.lol 5 days ago
Bottom of the page says what to do and gives 2 options to mitigate:
So if you disable password auth and only allow key auth, then you are unaffected (safe).
The introis a bit confusing but it means that if you have password auth on - then even if your regular ssh login requires a key, you are not safe.
smiletolerantly@awful.systems 5 days ago
Ah. Thanks for the correction. The intro + where I originally learned this from made me overreact a bit, it seems.