SSH servers on Alpine Linux and other musl-based systems may accept long passwords for accounts that should not allow password login(sshhole.com)
Writing language: KoreanRead in the original language
Plain summary
- On Alpine Linux and OpenWrt, which use the musl standard library, the source says accounts that should not accept passwords (for example, accounts that only allow key-based login) may pass with a password between 257 and 1024 characters long.
- The author attributes this to musl's crypt() function returning * in the password field when it fails on input longer than 256 bytes. This is the author's analysis and has not been verified outside the source.
- The author tried about 17,600 login attempts across several combinations of glibc, musl, and whether PAM is used. They report that only musl builds without PAM wrongly accepted logins. The author performed this measurement.
- The source says updating to openssh 10.6p2 or later fixes the problem, and if updating is difficult, recommends turning off password login. The accuracy of the fixed version has not been verified outside the source.
Editorial opinion
O: This fits a scene where an administrator who runs a deploy account that accepts only SSH key logins, on an Alpine Linux based Docker image or an OpenWrt router, first applies the password login disabling setting that the original article describes on a test server.
X: The original says the problem only occurs in a musl environment without PAM, but this judgment relies on the author's analysis and measurements, so before turning off password login, you should first confirm that key login works properly.
Writing language: Korean
Found on
Hacker News ↗ / 1,554 votes / 424 comments
Have you run into something like this? Tell us in a line or two what you did. You do not need to know the product.