2026-11-05 17:56 UTC
so openssh on musl linux (alpine, openwrt, buildroot, yocto, and a lot of the docker images you've pulled) has had a little problem since 2016.
accounts that should never take a password at all (root, your key-only deploy user, ldap users, the default user on alpine's aws and azure images) take any password longer than 256 characters.
https://sshhole.com/
Apply patches ASAP and see https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/
Replies (5)
-
@pluhmen@kanoa.de 2026-11-05 18:11
@nixCraft@mastodon.social It has always been best practice to disable ssh password auth. Doing so as the f***ing standard saves a lot.
-
@bjo@schafweide.eu 2026-11-05 18:12
@nixCraft@mastodon.social OpenWRT uses Dropbear and AFAIK Dropbear is not affected?
-
@ingonymous@mastodon.social 2026-11-05 19:25
@nixCraft@mastodon.social I am really missing the days when Linux fanboys made their daily jokes about windows vulnerabilities
-
@doragasu@mastodon.sdf.org 2026-11-05 21:28
@nixCraft@mastodon.social Wow, this is bad.
-
@mavu@mastodon.social 2026-11-05 21:59
@nixCraft@mastodon.social i love it when my stubborn hate of containers makes my stuff immune to the latest security disaster. K8S? more like K8ass lol Docker? just mock'er hahH