Alternatively, you can set the passwords, but I don't do this because it seems to actually break the graphical login:
I actually figured this out... it seemed strange, but I gave wrong instructions it seems,
pam-auth-update # select everything but extrausers
Here is the catch, last option of pam-auth-update is ... None of the above ... so it would disable standard login as well, instructions should've been select everything but extrausers and none of the above.
Anyway, I will be publishing newer images with this things fixed soon, so you won't also need to do "hacks" for ssh..