Critical OpenSSH Flaw Allows Passwordless Login on Alpine Linux
A recently uncovered vulnerability in OpenSSH jeopardizes the security of certain Linux systems, notably Alpine Linux, by allowing unauthorized users to log in without knowing the actual password. The flaw, known by the nickname *sshole, exploits a specific password verification weakness present in systems using the musl C library.
How the *sshole Vulnerability Works
The security gap arises when OpenSSH, running without Pluggable Authentication Module (PAM) support, relies on the musl library’s crypt function. If the password input exceeds 256 characters, musl fails to process the hash and instead returns an asterisk (*). This result coincides with the asterisk stored in the user’s password field, which usually signals that no password login is allowed. However, due to this quirk, the system mistakenly accepts the long incorrect password as valid, thus granting access without proper credentials.
This vulnerability originated from a 2016 OpenSSH update intended to mitigate username enumeration issues but inadvertently enabled this bypass on musl-based systems. While the flaw remained undetected for years, security researcher zgür Kıltetkin discovered it recently using AI-driven testing that performed tens of thousands of authentication attempts.
Systems Affected and Response
The issue predominantly impacts Alpine Linux OpenSSH server installations without PAM enabled and where password authentication is on by default. Affected systems include those shipping with root account password entries marked with * as well as key-only user accounts created without passwords. Official Alpine Linux cloud images on major platforms like AWS and Azure are also vulnerable, as they commonly have a default alpine account set up with passwordless access.
Linux distributions employing the more common GNU libc (glibc) or utilizing PAM for authentication remain unaffected. OpenSSH responded by releasing version 10.6p2 to address the flaw and emphasized the risk of compromised machines if suspicious logins are detected, recommending immediate actions such as disabling password authentication or shutting down SSH access.
Significance for Pakistani Users and Enterprises
Given Alpine Linux’s popularity in cloud environments and containerized deployments, this vulnerability carries serious implications for businesses and users worldwide, including in Pakistan. Many Pakistani startups and enterprises depend on cloud infrastructure using Alpine Linux for its lightweight and secure nature. An unnoticed remote access gap could expose critical digital assets to attackers, elevating cybersecurity risks amid increasing cyber threats in the region.
Pakistan’s expanding IT industry and growing reliance on remote server management mean administrators should promptly review their OpenSSH configurations and update to patched versions to protect against potential breaches leveraging this flaw. The case underscores the critical need for continuous security audits, especially for systems employing less common libraries or default settings that may obscure hidden vulnerabilities.
As Abdul Wasay, a leading cybersecurity reporter, notes, “Administrators should treat any machine with unusual login activity as compromised and act swiftly to contain possible damage.”
