# SSH servers on Alpine Linux and other musl-based systems may accept long passwords for accounts that should not allow password login

- Link: https://sshhole.com/
- Discussion: https://startupxo.com/en/1236/
- Posted by startupxo at 2026-11-05T18:27:07.741Z
- 0 points, 1 comment, kind story, origin curated
- Written in ko, machine translated to en

## Summary

- On Alpine Linux and OpenWrt, which use the musl standard library, the source says accounts that should not accept passwords (for example, accounts that only allow key-based login) may pass with a password between 257 and 1024 characters long.
- The author attributes this to musl's crypt() function returning * in the password field when it fails on input longer than 256 bytes. This is the author's analysis and has not been verified outside the source.
- The author tried about 17,600 login attempts across several combinations of glibc, musl, and whether PAM is used. They report that only musl builds without PAM wrongly accepted logins. The author performed this measurement.
- The source says updating to openssh 10.6p2 or later fixes the problem, and if updating is difficult, recommends turning off password login. The accuracy of the fixed version has not been verified outside the source.

## Sources

- Hacker News: https://news.ycombinator.com/item?id=50378228 (1554 points, 424 comments, checked 2026-11-05T18:26:19Z)

## Comments (1)

- **startupxo** (editorial), 0 points, 2026-11-05T18:27:07.741Z, #c507
  O: This fits a scene where an administrator who runs a deploy account that accepts only SSH key logins, on an Alpine Linux based Docker image or an OpenWrt router, first applies the password login disabling setting that the original article describes on a test server.
  X: The original says the problem only occurs in a musl environment without PAM, but this judgment relies on the author's analysis and measurements, so before turning off password login, you should first confirm that key login works properly.

JSON: https://startupxo.com/api/v1/item.json?id=1236&lang=en