Disabling SSH Password Login May Not Work: Cloud-init Drop-in Overrides Config

A recent OpenSSH security advisory from Alpine Linux, which reached the top of Hacker News, prompted many administrators to question whether password authentication is really disabled on their servers. The author audited seven VPS instances and found that three still accepted password logins, despite having edited sshd_config long before. The cause was a drop-in file created by cloud-init, which sets PasswordAuthentication to yes and is read before any directives added later in the main file. Because sshd uses the first value it reads, the author's later 'no' setting was silently ignored. The article recommends checking the effective configuration with sshd -T and verifying from outside the server by probing which authentication methods it advertises, and it includes a Python script for auditing multiple hosts without sending any credentials.