OpenIndiana Distribution

The following code fragment in sshd_config is misleading:

# To disable tunneled clear text passwords, change PasswordAuthentication to no.
PasswordAuthentication yes

Indeed, Setting PasswordAuthentication to "no" will NOT disable clear-text
passwords if ChallengeResponseAuthentication keeps its default value "yes" .
One also needs to set ChallengeResponseAuthentication to "no".

See for details, eg.
[[https://access.redhat.com/solutions/336773]]
or
[[https://blog.tankywoo.com/linux/2013/09/14/ssh-passwordauthentication-vs-challengeresponseauthentication.html]]

The above code fragment should be replaced by

# To disable tunneled clear text passwords, change PasswordAuthentication and ChallengeResponseAuthentication to no.
PasswordAuthentication yes
ChallengeResponseAuthentication yes