Password authentication is an SSH login method in which a user proves identity by supplying an account password, rather than a cryptographic key. The SSH server checks the password through the system’s configured authentication mechanisms, which may include PAM or local account data.
Because passwords can be guessed, reused, or stolen, this method can expose remote systems to brute-force attacks and credential theft. In configuration-dependent flaws, interactions among OpenSSH, the system’s C library, account settings, and authentication modules may also affect whether a password login is accepted. Administrators should patch affected software, review SSH and PAM settings, restrict access, and consider disabling password logins when key-based access is practical and safely managed.