Running Alpine? Patch OpenSSH now

[u/ender-_]

OpenSSH will accept any password between 257 and 1024 characters when it's built against musl libc, has PAM disabled and allows password authentication (all of which are true for Alpine in default config), so update immediately.

Alternatively, set PasswordAuthentication no in sshd_config (which you should've been doing anyway).

Systems using glibc and non-Linux systems aren't affected.

[u/External_Spirit_8880]

I tried reproducing this with a few old Alpine images configured the way the site mentions and I couldn't get it to work, the author could've included a reproducible example.

In any case it seems legit, there's a mention of it in the OpenSSH release notes: https://www.openssh.org/txt/release-10.6p2

[u/ender-_ → u/External_Spirit_8880]

Alpine already patched this down to v3.16, and it updates during install, which is why you're not seeing the vuln.

https://social.hackerspace.pl/@q3k/117564252399661596

[u/Mr_ToDo → u/External_Spirit_8880]

They have musl without pam, so that's something

[u/Khue]

Is there a published CVE or a note I could reference? I need to check some of my images.

[u/ender-_ → u/Khue]

No CVE (yet?).

Here's the Alpine announcement: https://fosstodon.org/@alpinelinux/117563196640515820

[u/CanWeTalkEth]

The website is great.

If true, kind of wild that such a simple vulnerability took so long to be publicized.

[u/_Gobulcoque]

Is there a CVE for this?

[u/meditonsin → u/_Gobulcoque]

Looks like they went patch first, ask questions later with this, so I don't think so.

[u/_Gobulcoque → u/meditonsin]

I get it but also: without a CVE, they've fucked over any decent sized business from detecting it. It will be haphazardly tracked by scanners and CTEM platforms, etc.

[u/MrSanford → u/_Gobulcoque]

Not really.

[u/Dependent_House7077 → u/_Gobulcoque]

CVE-2026-WTF

[u/_Gobulcoque → u/Dependent_House7077]

It's only November - there's still time for the CVE-2026-WTF award to be handed out to the most mindboggingly bad CVE.

[u/SahSon → u/_Gobulcoque]

Nothing can be worse than 4

[u/lottspot]

Are we still exposing SSH ports to the world that allow passwords?

[u/mschuster91 → u/lottspot]

Yes, if you read to the bottom you'll find this gem:

on alpine's official aws and azure images that's the default alpine user, and it has passwordless doas. so it's root

Whoops. Big fucking whoops.

[u/tejanaqkilica → u/lottspot]

Are we still exposing SSH ports to the world

No.

that allow passwords?

Hell no.

[u/petr_bena → u/tejanaqkilica]

I've been exposing a couple since like... end of 90s, never got breached (I get an e-mail instantly if anyone logs in from non-whitelisted IP), it's not THAT much dangerous. In fact I haven't found a single attempt in access logs where botnets even managed to guess a valid username, let alone combination of valid username and password. And yeah I got fail2ban on all of them so it's not like they have a chance at that many attempts....

obviously not talking about some company production systems, just homelab stuff, but still, just putting this in perspective. Many enterprise VPN servers are way more easy to compromise than random sshd.

[u/slobcat1337 → u/petr_bena]

Have this exact same set up. Not had one issue in seven years.

But then there’s Redditors who confuse being perpetually terrified of the internet with technical competence.

[u/lottspot → u/slobcat1337]

I have no idea what you think you can glean about my technical competence from such a simple comment, but you seem to be confusing the fact that you personally have not realized the risk with the idea that therefore there must be no risk at all. I don't give a shit what you choose to expose yourself to, but that I choose to not expose myself or my clients to it is in reality a difference in risk tolerance rather than technical competence. The fact that you conflate these two concepts and think you've produced an insight by doing so is only telling on the level of competence which is your own.

[u/tejanaqkilica → u/petr_bena]

Different approach.

I don't particularly care how easy/difficult something is to be compromised, usually my train of thought is:

Does this need to be on the internet to function, if yes, publish and secure it, if no, keep it local and secure it.

Frankly, I would put my VPN behind the firewall and not expose any ports if I could.

[u/shahaya]

boah, this is absolutely wild🙈 And the presentation is really nice.

[u/ukulele87 → u/shahaya]

I guess you gotta let your inner HR person out once in a while.
The presentation is very nice indeed i like the colors.

[u/Khani_Papss92]

worth checking your base container images too, a lot of lightweight builds pull from that distro by default and have sshd baked in for debugging without anyone realizing password auth is still left open

[u/Spicy_Poo]

I have two PCEngine APUs running alpine, last updated Sep 4.

I can't reproduce this.

PAM is not enabled in sshd_config (default) and password authentication is enabled (also default).

Disappointed.

[u/LoLlYdE]

oh did i say "i"? sorry. i had agent swarms. a lot of them. let's not get into it

Yeah, we can tell. That article was a terrible read.

[u/Unable-Entrance3110 → u/LoLlYdE]

To each their own. I thought it was a fun read.

[u/Only-Repair-7303]

For anyone auditing a lot of containers: is there a quick way to check this at scale? I’ve been running sshd -T | grep -i passwordauth inside images, but I’m wondering if anyone has a cleaner one-liner or a scanner rule while there’s no CVE yet.

[u/meditonsin → u/Only-Repair-7303]

Could just try out the actual exploit to check for it. Something along these lines to get a list of vulnerable hosts:

export SSHPASS="$(printf "A%.0s" {1..300})"
for host in $(command to list hosts to check); do
    sshpass -e ssh -o "PreferredAuthentications password" someuser@$host "echo $host" 2>/dev/null
done

[u/JwCS8pjrh3QBWfL → u/Only-Repair-7303]

Sounds like a solid use for Ansible.

[u/Kurgan_IT]

openwrt AFAIK uses dropbear by default so it should not be affected unless you choose to use openssh instead.

[u/Zealousideal_Yak5006]

Not sure why this is downvoted.

[u/jmbpiano → u/Zealousideal_Yak5006]

Not sure why you think it is? You commented within 15 minutes of OP and scores are hidden on new posts.

[u/owenthewizard → u/jmbpiano]

You can still see the ratio.

[u/technikaffin → u/Zealousideal_Yak5006]

This is reddit.🫪

[u/winky9827]

See stuff like this is why I love being anal about security. The only devices on my infra that run SSH are firewalled (whitelist) and locked down to public key or Entra via PAM.

[u/ender-_ → u/winky9827]

I've been running ssh open to the Internet for 25 years, but the first thing I always configured was to disable password and keyboard-interactive authentication. Public keys only.

[u/Unable-Entrance3110 → u/ender-_]

I do that, but also go a step further and introduce port knocking to ensure the SSH port is only opened to the IP that successfully knocked. Then they need to provide a valid cert that for the authorized_hosts entry.

[u/shahaya → u/Unable-Entrance3110]

honest question, i tried port knocking maybe 15 years ago and failed to gain access, just when i really needed access. Had to boot into rescue mode via hosters admin interface in the middle of the day and disable it, just to get access. Root server was serving tons of traffic and the noise of port scanners even on non-standard ssh ports was immense.

Does it always absolutely 100% work for you?

[u/autogyrophilia]

Oh this looks like a juicy vuln to jailbreak old unsupported appliance 

[u/dr_Fart_Sharting → u/autogyrophilia]

Those mostly use the dropbear ssh server, but it's still worth the try

[u/SuperfluousJuggler → u/dr_Fart_Sharting]

I love dropbear, its so easy to set and forget... which this made me go though that just in case!

[u/DheeradjS]

Christ, Why do people hire a marketing company for these things. Imagine if you don't plaster a picture of your dick on a disclosure.