Second, the target system account must be configured to be passwordless. Passwordless accounts are commonly used for accounts that use certificate-based authentication.
“passwordless” here means that the account doesn’t have a password. What the person you’re replying to means is that password authentication should be completely disabled in the SSH config, as that’s the only way to exploit this issue.
But passwords need to be enabled for SSH. You must submit a faulty password of a specific kind, and the SSH server misinterprets it for passwordless accounts, which means the server must be configured to allow you to attempt a password.
When logging into a passwordless account, the attacker can gain access by inputting more than 256 characters in the password field.
If you disable passwords in SSH, there is no password field. There is no way for you to input anything. The connection will just be refused as the only auth method is an ssh key. If there is no matching key, SSH will refuse the connection.
If you don’t do that, the daemon will fall back to a password, which might then be vulnerable. However, no sane administrator would leave password auth enabled. Usually, you use the SSH password once - to copy an SSH key on the system. Then you disable it.
The vuln is specifically for key-based accounts:
“passwordless” here means that the account doesn’t have a password. What the person you’re replying to means is that password authentication should be completely disabled in the SSH config, as that’s the only way to exploit this issue.
But passwords need to be enabled for SSH. You must submit a faulty password of a specific kind, and the SSH server misinterprets it for passwordless accounts, which means the server must be configured to allow you to attempt a password.
If you disable passwords in SSH, there is no password field. There is no way for you to input anything. The connection will just be refused as the only auth method is an ssh key. If there is no matching key, SSH will refuse the connection.
If you don’t do that, the daemon will fall back to a password, which might then be vulnerable. However, no sane administrator would leave password auth enabled. Usually, you use the SSH password once - to copy an SSH key on the system. Then you disable it.