From the Alpine advisory and the researcher's notes: musl's crypt() gives back * when a password is over 256 bytes, and sshd then compares it with an account whose stored field is also *. Key-only users have that field, and so does the alpine user on tiny-cloud images. Fix is OpenSSH 10.6p2 or Alpine's backport (on 3.24 that's 10.3_p1-r2), plus an sshd restart. PasswordAuthentication no also closes it. Package table and check commands are in the link. Disclosure: it's our blog, we run a proxy service.