AI Weekly Malaysia

OpenSSH on musl-based Linux (Alpine, OpenWrt, Buildroot, Yocto, many Docker images) has since 2016 accepted any password longer than 256 characters for accounts whose password field is `*` — root, key-only deploy users, LDAP users, and Alpine's default AWS/Azure user. The chain: musl's `crypt()` returns `*` when SHA-512 crypt fails on >256-byte input, so sshd compares `*` to the stored `*` and authenticates. The write-up traces the `*` convention to 1980 Unix and the musl commits from 2012.

Why: If you run sshd inside an Alpine/musl container or appliance and rely on `*` to lock accounts, password auth is not actually disabled for >256-char inputs; set `PasswordAuthentication no` and `KbdInteractiveAuthentication no`, or patch/upgrade, and check whether your images even include openssh-server.

Alpine Linux published an advisory for an OpenSSH-server password authentication bypass: an attacker who can reach the SSH port can log in without a password by sending a 257–1024 byte password, provided the target account has a * password field and at least one account on the host has a $5$ or $6$ hash. It affects Alpine 3.16 through 3.24 and edge when openssh-server is built without PAM or openssh-server-pam uses UsePAM no, and PasswordAuthentication is yes. Fixed packages are in Alpine 3.21.10, 3.22.8, 3.23.8, and 3.24.4; upgrading alone does not replace the running daemon.

Why: If you run sshd on Alpine with the default PasswordAuthentication yes, any key-only account — root:* in the base image or a user created without a password — can become a login path for an attacker, so you need to restart sshd after apk upgrade or set PasswordAuthentication no and restart. The operational trap is that apk upgrade -U -a alone leaves the old daemon running.

Ars Technica reports a vulnerability nicknamed *sshole that lets attackers SSH into some Linux devices without a password. The article says certain configurations of Alpine are affected and other distributions may also be, with the subhead noting that any 256-character input will do. It was published November 5, 2026, and the page shows 9 comments.

Why: If you run an SSH daemon on Alpine, this is a direct check-now item: the article says some Alpine configurations allow passwordless SSH login. If you only use Alpine as a container base image without sshd, the excerpt gives no evidence you are affected. The text does not name a CVE, affected versions, or a patch, so get the vendor advisory before treating it as a broad incident.

The Hacker News headline reports that OpenSSH shipped an emergency fix for a flaw that lets unusually long passwords bypass SSH authentication specifically on Alpine Linux. Beyond the title, the supplied page text is almost entirely site navigation and boilerplate, so there are no affected version numbers, CVE identifier, patch release name, or exploit conditions to work from.

Why: Concretely, the one actionable fact is narrow: if you run SSH on Alpine Linux (common as a base image for small containers), an over-long password can reportedly authenticate without the correct credential, so patching OpenSSH on Alpine hosts is the specific action. Because the text gives no version range, no CVE, and no confirmation of whether the default Alpine sshd config is exposed, you cannot yet judge your own exposure from this item alone — check the actual advisory before assuming you are or aren't affected.