OpenSSH running w/o keys!

Recently installed the latest copy of OpensSH for Windows [3.6.1p1-1 Installer
Build 20030512] on two Win2K AdvServers. [BTW: Kudos to Mike for the fine job
and for his BS in Lit.]. Tested one install against a Linux install (p1-2 I
believe) and all worked fine. Only oddity is that w/o authorized_keys file I
could log into Win2K box with the account password.

Next tried logging in between the two Win2K boxes (endpoints in our lab's
testbed; just a couple of routers in between). Made an account on each box
with same name but diff passwords and basic user rights. Both were added to
their respective passwd files.

Using pregenerated keys was able to log into each account from each box, each
account using it's own password. Tried authorized_keys for seamless entry but
no success.

In my troubleshooting I removed all keys and known_hosts. As expected it gives
the warning about this being a new machine, I answer yes and it creates a new
known_hosts file. But then w/o keys at either end it allows me to log into the
other box if I use the proper password??? Checked sshd_config (used original
unmodified) against the Linux box and only diffs are UsePrivilegeSeperation [L
= yes] MaxStartups[L =10 vs 10:30:60] and sftp path [not likely cause].
Haven't checked a dump to see if the login is encrypted or not.

Any ideas on why/how this is happening or how to fix. Thanks.

---------------------------------------------
This message was sent via the BiznessOnline.com webmail system.
http://www.biznessonline.com

--
List Information: http://tech.erdelynet.com/mailman/listinfo/ssh-l/
List Archives:    http://erdelynet.com/archive/ssh-l/
To Unsubscribe: Go to http://tech.erdelynet.com/mailman/listinfo/ssh-l/ and enter your email address at the bottom to "Edit Options". If you don't know your password, have it emailed to you. Then unsubscribe.