Alpine Linux SSH lets attackers log in without password via *sshole
Original title: Meet *sshole, the vulnerability that lets hackers SSH into Linux devices
Alpine Linux and other distributions using OpenSSH with musl without PAM allow passwordless SSH access when SHA256 or SHA512 hashes and passwordless accounts are configured.
A decade-old vulnerability in the interaction between OpenSSH and musl in Alpine Linux (and possibly other distributions) enables attackers to log into devices with no password. The attack requires a system with at least one user account hashed using SHA256 or SHA512 and a passwordless account specified by a “*” in /etc/shadow. Alpine maintainers state it takes one connection, works every time, and needs no retries. Checkpoint researchers confirmed the conditions and noted that root accounts configured with PermitRootLogin prohibit password remain protected.
- Requires SHA256 or SHA512 hashed passwords
- Passwordless accounts common for certificate-based authentication
- Root accounts safe under default prohibit password setting
- Tool calls succeed 99.9% of the time
- Affected distributions using OpenSSH and musl without PAM
Impact: unauthenticated remote SSH login as any user
From the original article
1 min read at arstechnica.com
Certain configurations of Linux are affected. Other distros may be as well.
By Dan Goodin · arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.