A Linux account with no password can still log in over SSH. Alpine servers go first.
By Lior AharonovFounder, 7IT Solutions ·
What happened
A flaw dating back to 2016 lets an attacker log into accounts that are meant to block password logins, by sending a password over 256 bytes. It needs musl-based Linux, PAM off, password login on, and one account with a valid hash. Fixed in OpenSSH 10.6p2, reported on 5 November.
Why it matters
Alpine's official AWS and Azure images ship an alpine account with passwordless doas. Picture a container host where a locked account walks straight to root. The source does not report attacks yet.
What to do
If you run Alpine, OpenWrt, Buildroot or Yocto, run apk upgrade openssh or your distro's update today. Until then set PasswordAuthentication no and restart sshd.
My take
Lior Aharonov
Founder, 7IT Solutions
Locked accounts are only locked until someone sends the wrong-sized password. Turn off SSH passwords and stop worrying about hashes.
Sources
| BleepingComputer: OpenSSH flaw lets attackers log into password-disabled Linux accounts | bleepingcomputer.com |
Researched with AI tools; every fact is checked against the linked sources.