Comment on Update all your stuff, NOW - again.

• AHemlocksLie@lemmy.zip ⁨5⁩ ⁨days⁩ ago

  The “are you affected?” section directly contradicts this. It outright states you must have password authentication enabled. Otherwise, SSH never gives you a chance to even attempt a password.

  original
• HelloRoot@lemy.lol ⁨5⁩ ⁨days⁩ ago

  Bottom of the page says what to do and gives 2 options to mitigate:

  # update. openssh 10.6p2 fixes it.
  $ apk upgrade openssh
  
  # can't update yet? turn password logins off.
  $ echo "PasswordAuthentication no" > /etc/ssh/sshd_config.d/00-no-passwords.conf
  $ rc-service sshd restart
  

  So if you disable password auth and only allow key auth, then you are unaffected (safe).

  The introis a bit confusing but it means that if you have password auth on - then even if your regular ssh login requires a key, you are not safe.

  original

  • smiletolerantly@awful.systems ⁨5⁩ ⁨days⁩ ago

    Ah. Thanks for the correction. The intro + where I originally learned this from made me overreact a bit, it seems.

    original