See bugfix https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759737
"yes". "without-password" is the new default config, more secure, but can't login if we don't create normal user account.