[Bug 263045] sshd allows password logins when "PasswordAuthentication no" is set

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=263045

--- Comment #6 from donaldcallen@gmail.com ---
(In reply to Marek Zarychta from comment #5)

It could well be the way I'm saying it, and therefore my fault, but you are not
understanding my point.

The bug is the way the defaults are set in FreeBSD. The default setting for
PasswordAuthentication  is 'no', which leads an unsuspecting reader who has the
crazy idea that no means no to think that password authentication is disabled
when it is not.

In my opinion, in FreeBSD, if the desired default state is that password
authentication is enabled, then PasswordAuthentication should be 'yes' by
default, which would not change sshd's behavior but would make things clearer
to the reader of the config file. It would also be nice if there were a comment
in the config file that said something like "To turn off password
authentication, both PasswordAuthentication *and* KbdInteractiveAuthentication
must 'no".

-- 
You are receiving this mail because:
You are the assignee for the bug.