Enabling SSH Password Authentication on Alpine Linux Cloud Images (via NoVNC Console)

By default, Alpine Linux cloud images use key-based SSH authentication only, with password login disabled for security reasons. This prevents brute-force and credential-guessing attacks on freshly deployed systems.

However, in certain cases (e.g., initial setup, troubleshooting, or when SSH key integration isn’t available), you may need to temporarily enable SSH password authentication.

This guide explains how to do so safely using the NoVNC console.

Security Warning:
Password authentication is less secure than SSH keys. Enable it only when necessary and revert afterward.
If you must keep it enabled, use strong passwords, firewall rules, and tools like fail2ban.

Overview of Steps

1. Access your instance via NoVNC console
2. Switch to root (if not already)
3. Back up SSH configuration
4. Edit /etc/ssh/sshd_config
5. Ensure the root account has a password
6. Test the SSH configuration
7. Restart SSH
8. Verify access and harden security

Step 1: Open the NoVNC Console

Your cloud provider (e.g., virtnet.bond) offers a NoVNC web console to access your server even if SSH is not yet working.

Log in as your main user or root.
 If you’re not root, elevate privileges:

doas -s
# or, if using sudo
sudo -i

Step 2: Back Up the SSH Configuration

Always back up your SSH config before editing:

cp -av /etc/ssh/sshd_config /etc/ssh/sshd_config.bak-$(date +%F-%T)

Step 3: Edit /etc/ssh/sshd_config

Open the SSH configuration file with your preferred text editor:

vi /etc/ssh/sshd_config
# or
nano /etc/ssh/sshd_config

Find and update (or add) these lines:

PasswordAuthentication yes
ChallengeResponseAuthentication no

Note: Alpine’s openssh build does not use PAM by default, so you can ignore UsePAM.

If you also want to allow root login via password (⚠️ very risky):

PermitRootLogin yes

Otherwise, leave it as:

PermitRootLogin prohibit-password

Save and exit the editor.

Alternative: Edit Non-Interactively

If you prefer using sed:

sed -i.bak -E 's/^\s*#?\s*PasswordAuthentication\s+.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
sed -i -E 's/^\s*#?\s*ChallengeResponseAuthentication\s+.*/ChallengeResponseAuthentication no/' /etc/ssh/sshd_config
# Optional: enable root login
sed -i -E 's/^\s*#?\s*PermitRootLogin\s+.*/PermitRootLogin yes/' /etc/ssh/sshd_config

Step 4: Ensure the Root Account Has a Password

If you plan to log in as root using a password, make sure it has one:

passwd root

Enter and confirm a strong password (at least 16 characters, including symbols/numbers).

Step 5: Test SSH Configuration

Before restarting SSH, test for syntax errors:

sshd -t

If no output appears, the configuration is valid.
 If there’s an error, fix it or restore your backup:

cp /etc/ssh/sshd_config.bak-* /etc/ssh/sshd_config

Step 6: Restart the SSH Service

Alpine uses OpenRC, not systemd. Restart SSH with:

rc-service sshd restart

Check its status:

rc-service sshd status

If it shows “started” or “running,” the daemon is active.

Step 7: Test SSH Login from Another Machine

From another system (not your NoVNC console), test logging in:

ssh user@your_server_ip

Or, if you enabled root login:

ssh root@your_server_ip

Keep the NoVNC console open in case you need to revert.

Step 8: Harden the Server (Highly Recommended)

If password authentication must remain enabled:

✅ Use a strong password (16+ chars, symbols, numbers)
🚫 Disable root login once finished:

sed -i 's/^PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
rc-service sshd restart

🔒 Restrict SSH access by IP using your cloud firewall or iptables
 🧱 Install fail2ban (optional, via community repo):

apk add fail2ban
rc-update add fail2ban
rc-service fail2ban start

Reverting to Secure Defaults

To restore your original SSH configuration:

cp -av /etc/ssh/sshd_config.bak-* /etc/ssh/sshd_config
sshd -t && rc-service sshd restart