diff -Nru openssh-10.4p1/debian/changelog openssh-10.4p1/debian/changelog
--- openssh-10.4p1/debian/changelog	2026-07-06 18:11:28.000000000 +0000
+++ openssh-10.4p1/debian/changelog	2026-07-18 13:52:55.000000000 +0000
@@ -1,3 +1,12 @@
+openssh (1:10.4p1-2) UNRELEASED; urgency=medium
+
+  * Build-Depends: add libcrypt-dev so crypt() is detected at build time,
+    fixing password authentication with UsePAM=no (Closes: #1142354).
+  * debian/rules: fail the build if crypt() is not detected.
+  * debian/tests: add password-auth-no-pam regression test.
+
+ -- Alexander Fisher <alex@linfratech.co.uk>  Sat, 18 Jul 2026 13:52:55 +0000
+
 openssh (1:10.4p1-1) unstable; urgency=medium
 
   [ Sven Joachim ]
diff -Nru openssh-10.4p1/debian/control openssh-10.4p1/debian/control
--- openssh-10.4p1/debian/control	2026-07-06 18:11:28.000000000 +0000
+++ openssh-10.4p1/debian/control	2026-07-18 13:52:55.000000000 +0000
@@ -9,6 +9,7 @@
  dh-runit (>= 2.8.8),
  dh-sequence-installsysusers,
  libaudit-dev [linux-any],
+ libcrypt-dev,
  libedit-dev,
  libfido2-dev (>= 1.5.0) [linux-any],
  libgtk-3-dev <!pkg.openssh.nognome>,
diff -Nru openssh-10.4p1/debian/rules openssh-10.4p1/debian/rules
--- openssh-10.4p1/debian/rules	2026-07-06 18:11:28.000000000 +0000
+++ openssh-10.4p1/debian/rules	2026-07-18 13:52:55.000000000 +0000
@@ -122,6 +122,10 @@
 
 override_dh_auto_configure-arch:
 	dh_auto_configure -Bdebian/build-deb -- $(confflags)
+	# configure treats a missing crypt() as non-fatal, so check explicitly;
+	# without it sshd-session loses password authentication.
+	grep -q '^#define HAVE_CRYPT 1' debian/build-deb/config.h || \
+		{ echo >&2 "crypt() not detected; is libcrypt-dev installed?"; exit 1; }
 ifeq ($(filter noudeb,$(DEB_BUILD_PROFILES)),)
 	dh_auto_configure -Bdebian/build-udeb -- $(confflags_udeb)
 	# Avoid libnsl linkage. Ugh.
diff -Nru openssh-10.4p1/debian/tests/control openssh-10.4p1/debian/tests/control
--- openssh-10.4p1/debian/tests/control	2026-07-06 18:11:28.000000000 +0000
+++ openssh-10.4p1/debian/tests/control	2026-07-18 13:52:55.000000000 +0000
@@ -50,3 +50,15 @@
  openssh-server,
  passwd,
  xinetd,
+
+Tests:
+ password-auth-no-pam,
+Restrictions:
+ allow-stderr,
+ isolation-container,
+ needs-root,
+Depends:
+ openssh-client,
+ openssh-server,
+ passwd,
+ sshpass,
diff -Nru openssh-10.4p1/debian/tests/password-auth-no-pam openssh-10.4p1/debian/tests/password-auth-no-pam
--- openssh-10.4p1/debian/tests/password-auth-no-pam	1970-01-01 00:00:00.000000000 +0000
+++ openssh-10.4p1/debian/tests/password-auth-no-pam	2026-07-18 13:52:55.000000000 +0000
@@ -0,0 +1,40 @@
+#!/bin/sh
+# With UsePAM=no, sshd verifies the password itself via crypt().
+# Built without libcrypt, valid logins fail as if the password were wrong.
+set -e
+
+TESTUSER=nopamtest
+TESTPASS=Passw0rd-nopam
+PORT=2022
+WORKDIR=$(mktemp -d)
+
+cleanup() {
+    [ -f "$WORKDIR/sshd.pid" ] && kill "$(cat "$WORKDIR/sshd.pid")" 2>/dev/null || true
+    userdel -r "$TESTUSER" 2>/dev/null || true
+    rm -rf "$WORKDIR"
+}
+trap cleanup EXIT
+
+useradd -m -s /bin/sh "$TESTUSER"
+echo "$TESTUSER:$TESTPASS" | chpasswd
+
+ssh-keygen -q -t ed25519 -f "$WORKDIR/hostkey" -N ""
+cat > "$WORKDIR/sshd_config" <<EOF
+Port $PORT
+ListenAddress 127.0.0.1
+HostKey $WORKDIR/hostkey
+PidFile $WORKDIR/sshd.pid
+UsePAM no
+PasswordAuthentication yes
+KbdInteractiveAuthentication no
+PubkeyAuthentication no
+EOF
+
+/usr/sbin/sshd -f "$WORKDIR/sshd_config"
+
+sshpass -p "$TESTPASS" \
+    ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
+        -o PreferredAuthentications=password \
+        -p "$PORT" "$TESTUSER@127.0.0.1" true
+
+echo "PASS: UsePAM=no password authentication succeeded"