In Alpine, these would all be the case for an out of the box install with openssh added unless you specifically install openssh-server-pam and configure sshd_config to use PAM (Alpine is already musl-c based).

Doesn't it also need a user to be added with a password entry?

I only ever see Alpine Linux used for containers which don't need accounts with interactive user logins, which is not to say it doesn't exist, just that it doesn't seem like Alpine comes with all preconditions met out of the box

Isn't it the opposite, accounts which have no password and hence had * instead of a hash? I.e. the bug is:

> accounts that should never take a password at all (root, your key-only deploy user, ldap users, the default user on alpine's aws and azure images) take any password longer than 256 characters.

But the correct behavior was supposed to be:

> a * isn't a hash, so no password can match it. unix still does this today'

> and if the field is just *? there's nothing to match. type whatever you want, it's never getting you in

The part in your edit is indeed what I was referring to, sorry that could have been clearer