51
openssh on musl linux has been letting people into password-less accounts since 2016 (sshhole.com)
submitted 1 day ago by to c/linux@lemmy.ml
17 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 7 points 1 day ago (2 children)

I have 4 accounts on my OpenWRT router with * as their password, but I did try with a random password over 256 characters and I couldn't log into them.

daemon:*:1:1:daemon:/var:/bin/false
ftp:*:55:55:ftp:/home/ftp:/bin/false
network:*:101:101:network:/var:/bin/false
nobody:*:65534:65534:nobody:/var:/bin/false

Still, this is a huge security flaw!

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 6 points 1 day ago (1 child)

    I thought openwrt uses dropbear? Looks like I have password auth turned off anyways so I'm good.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 1 day ago

    You're absolutely right. I just read the article and as it pointed out OpenWRT I wanted to make sure and tested it anyway. OpenWRT doesn't even have any SSHD packages available, so that's good. But as I've installed the OpenSSH-sftp-server package quite a few times I probably got confused on top of that as well.

  • permalink
  • fedilink
  • source
  • parent