46
sshole: OpenSSH on musl without PAM lets * accounts in with any 256+ byte password (fixed 5 Nov) (proxymint.com)
submitted 1 day ago by to c/linux@programming.dev
2 comments fedilink hide all child comments
 

From the Alpine advisory and the researcher's notes: musl's crypt() gives back * when a password is over 256 bytes, and sshd then compares it with an account whose stored field is also *. Key-only users have that field, and so does the alpine user on tiny-cloud images. Fix is OpenSSH 10.6p2 or Alpine's backport (on 3.24 that's 10.3_p1-r2), plus an sshd restart. PasswordAuthentication no also closes it. Package table and check commands are in the link. Disclosure: it's our blog, we run a proxy service.

you are viewing a single comment's thread
view the rest of the comments
[–] [S] 3 points 9 hours ago

nice. the ones people tend to forget are alpine-based containers that run sshd inside. on alpine ssh -V won't settle it, since the fix is a backport, so check the package with apk info openssh instead.

  • permalink
  • fedilink
  • source
  • parent