sshd: attempt to clarify PasswordAuthentication

[emaste]

Summary

As reported in PR263045 the PasswordAuthentication option is unclear. Based on the name users expect that it enables or disables the use of passwords for authentication in general, rather than specifically RFC 4252 password authentication. Passwords can also be used with RFC 4256 KbdInteractiveAuthentication, which we use by default on FreeBSD.

[manu]

I remember being confused a long time ago with this so +1 :)

[emaste]

crypto/openssh/sshd_config

59–60

Some twitter commenters did not like including the RFCs here and I basically agree; I added them to try to indicate that this is a specific type of "password" authentication, not the use of passwords in general. Perhaps instead just add a comment here "Passwords may also be accepted via KbdInteractiveAuthentication."

[emaste]

Drop RFC numbers, just make reference to KbdInteractiveAuthentication from PasswordAuthentication description/comment.

[emaste]

crypto/openssh/sshd_config.5

1285

Perhaps add here:

Without PAM, PasswordAuthentication uses built-in master.passwd authentication.
With PAM, PasswordAuthentication uses the PAM modules configured for the "sshd" service.

but we need to expand the KbdInteractiveAuthentication description as well to indicate that it requires PAM.