Yeah, double-check the doc, and then set up shared key auth like a good citizen

.
Because tweaking passwd might do the job right now, but it's ugly, and will be useless the next time you update your device.
(And unless you already played with the config, the fact that the account is locked is irrelevant, everything is patched to let you in over USB in the default setup).