Security · High impactFan score 69 · Tier A7 sources193 comments in the community

Alpine Linux Security advisory: OpenSSH-server password authentication bypass

Hacker News: Front Page · By pantalaimon · 22h ago

Read the full story at alpinelinux.org ↗

The Brief

OpenSSH 10.6p2 was released with a workaround for a critical flaw affecting Linux systems that use musl libc with PAM disabled, such as Alpine Linux.
Dubbed "*sshole", the flaw lets attackers log into accounts configured to block password authentication by sending an oversized password.
Attackers need network access to the SSH server, an account name, and a password between 257 and 1,024 bytes long.

Why it matters

Servers on affected musl systems without PAM can be accessed through accounts that were meant to be key-only, so exposed SSH servers and Alpine-based containers need updating or hardening now.

Who’s affected

Alpine Linux and other musl-based systems running openssh-server without PAM
Teams running Alpine-based containers or servers with key-only SSH accounts

What to do

Upgrade to OpenSSH 10.6p2 or a later release that includes the workaround
If you cannot upgrade yet, set PasswordAuthentication no in sshd configuration and restart sshd, after confirming key-based login works

OpenSSH 10.6p2
#openssh
#ssh
#alpine-linux
#musl
#authentication
#vulnerability

What developers are saying

Based on 193 comments · Mixed reactions

Commenters treat the flaw as a serious problem rooted in musl's crypt() behaviour and praise the fast release, though some argue it reflects broader problems with C code and Alpine. Others say their own setups were unaffected, and some question whether the default Alpine install is vulnerable at all.

musl crypt() design flaw25%
Praise for fast disclosure15%
Whether Alpine defaults are affected15%
Disable password authentication advice20%
Criticism of C and distro choices25%

In favour

+ Fast release is justified by rapid rediscovery of bugs by AI agents and the risk of long embargoes
+ Disabling password authentication is a sound general hardening step

Concerns

− musl's crypt() returning '*' as an error indicator is seen as an unsafe API choice
− The default Alpine install may not be affected because it uses '!' as the shadow placeholder
− A workaround rather than a fix raises questions
− Following the advice blindly could lock administrators out of machines
− Docker containers are often slow to update their base images

“The musl code in question is nuts. The API it implements is awful.”
amluto on Hacker News

“i think it's just unbelievable there isn't a bigger push to move away from c to languages that can prevent stuff like this from happening.”
slopinthebag on Hacker News