this post was submitted on 05 Nov 2026
253 points (96.3% liked)

Selfhosted

63618 readers
392 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
253
Check if you need to update all your stuff - again. (sshhole.com)
submitted 2 days ago* (last edited 2 days ago) by smiletolerantly@awful.systems to c/selfhosted@lemmy.world
91 comments fedilink hide all child comments
 

are you affected?

  • is your sshd running on musl? (alpine, openwrt, buildroot, yocto)
  • is it not using pam? alpine's openssh-server doesn't by default, or maybe you set UsePAM no
  • are password logins still on? they are by default
  • is there an account with just * as its password? key-only users, ldap users, root on alpine
  • and some other account with a real password?
  • then that * account takes any password between 257 and 1024 characters

on alpine's official aws and azure images that's the default alpine user, and it has passwordless doas. so it's root

on debian, ubuntu, fedora or anything else with glibc? going through pam? dropbear? openbsd? you're fine

top 50 comments
sorted by: hot top controversial new old
[–] panda_abyss@lemmy.ca 64 points 2 days ago* (last edited 2 days ago) (2 children)

Jesus Christ. Why?! How?

Edit: I can't figure out how to upload gifs to Lemmy... please imagine castle-nathan.gif

[–] NoLemurs@lemmy.world 21 points 2 days ago (3 children)

castle-nathan.gif

I don't know why, but I always assumed that image was from Firefly. It's the same color shirt and everything!

[–] lka1988@lemmy.dbzer0.com 7 points 1 day ago

There are a lot of references to Firefly in Castle. It's quite entertaining.

[–] bjoern_tantau@swg-empire.de 7 points 1 day ago (1 children)

Didn't he dress up as a "space cowboy" in one episode?

load more comments (1 replies)
[–] Vittelius@feddit.org 6 points 2 days ago

I can't figure out how to upload gifs to Lemmy...

![alt text - optional, you can keep this empty, but you need the brackets](https://website.tld/castle-nathan.gif)

[–] tal@lemmy.today 40 points 2 days ago

did you get hacked? check.

$ grep "Accepted password" /var/log/messages

That's a really bad check unless you have an external box receiving logs and you're looking there, because the first thing that a sophisticated attacker is going to do if they get in as root is remove the signs of their presence.

[–] possiblylinux127@lemmy.zip 35 points 2 days ago

This isn't nearly as bad as I thought it was. Also the author is very reliant on AI to the point where they didn't think about what if someone wipes the logs.

Any effected devices should be wiped and redeployed

[–] HCSOThrowaway@lemmy.world 33 points 2 days ago* (last edited 2 days ago) (4 children)

I'm no cybersecurity expert, but from what I've heard from those who are, this is the new normal as anyone who formerly had no chance due to being a "script kiddie" can now just prompt an AI* to eventually find a vulnerability.

* oversimplification redacted

[–] colourlesspony@pawb.social 15 points 2 days ago (1 children)

Yep, those new fangled slop-kitties. The worst part is that there brute force hacking is being subsidized by people 401ks.

load more comments (1 replies)
[–] lemmyvore@feddit.nl 9 points 2 days ago (8 children)

It's not quite as simple as that. The author in this case followed a pretty specific trail to find the bug.

Where AI helped was as the last step. They already knew what the bug would do and where to look, but actually looking through the source code for all the possible musl implementations out there would have taken a lot of time.

So they brute-forced it instead and asked AI to spin up actual running instances of all those implementations and simply tried the bug against each of them, rather than looking at all the code.

load more comments (8 replies)
[–] hirihit640@sh.itjust.works 5 points 1 day ago* (last edited 1 day ago)

You'd think that but so far I haven't seen an actual PoC exploit for the PHP vulnerability that doesn't require misconfiguring the server. And this is over a week after the patches were released.

load more comments (1 replies)
[–] tofu@lemmy.nocturnal.garden 35 points 2 days ago (9 children)

I mean, not that it's not severe, but which container images have ssh baked in? If you're using good stripped down images, you're fine here.

Not sure where the overlap is between"ssh is enabled" and "one of those OSes". LXCs maybe?

[–] ikidd@lemmy.dbzer0.com 23 points 2 days ago* (last edited 2 days ago) (1 children)

SSH enabled and the SSH port of the container accessible and it's set for password auth.

load more comments (1 replies)
[–] HelloRoot@lemy.lol 7 points 2 days ago (6 children)

Maybe something like git forges and gist alternatives?

load more comments (6 replies)
load more comments (7 replies)
[–] tapdattl@lemmy.world 21 points 2 days ago (12 children)

I'm assuming this is only if you allow password authentication? If you're only allowing certificate based auth you should be safe, right?

[–] chameleon@fedia.io 24 points 2 days ago

Correct, password authentication must be enabled on the SSH daemon side of things to be vulnerable. The user account being logged into, on the other hand, can't have a password set. But overall, PW auth must be on. The website OP linked is exceedingly bad at explaining the actual problem, see Alpine's announcement for better info.

https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/

load more comments (11 replies)
[–] rtxn@lemmy.world 20 points 2 days ago* (last edited 2 days ago) (2 children)

That website is atrocious. It's the web design equivalent of shoving five kilograms of sugar and whipped cream in a cup of coffee.

[–] tal@lemmy.today 18 points 2 days ago (2 children)

Now, now. Starbucks is a very successful business.

load more comments (2 replies)
[–] lagoon8622@sh.itjust.works 5 points 2 days ago

"Cyber" ppl love to do this. This is basically their resume I guess? They have to sensationalize absolutely everything they can (not that this isn't an important bug, but this could have been a 1-2 page white paper imo (like many of them))

[–] lntl@lemmy.ml 12 points 2 days ago

I wouldn't recommend deploying any ssh server without reviewing the config and believe sane defaults are sane.

[–] danielquinn@lemmy.ca 8 points 1 day ago (2 children)

I've been setting UsePam = no for decades because leaving it on meant that it'd still present a password login of keys failed. Is this still the case, was I wrong from the beginning, or is this somehow ok?

[–] ScoffingLizard@lemmy.dbzer0.com 1 points 3 hours ago* (last edited 3 hours ago)

I'm not following. Are you saying you login with ssh keys and not the password, but leave "UsePam = no" so then if ssh fails you don't have a pam error?

[–] needanke@feddit.org 7 points 1 day ago

The way I read it, it is fine if you do not allow password authentication in general?

[–] Orygin@sh.itjust.works 12 points 2 days ago (1 children)

OP I know you're trying to do good, but please try to understand the vulnerability before spreading FUD

load more comments (1 replies)
[–] qaz@lemmy.world 12 points 2 days ago (1 children)

Most containers don't run ssh right?

[–] lemmyvore@feddit.nl 6 points 2 days ago

Unless it's explicitly installed no. The default Alpine image doesn't come with OpenSSH.

[–] GeneralDingus@lemmy.cafe 8 points 1 day ago

I use alpine with an ssh port exposed to the internet so I can connect to it. This doesn't seem to be an issue if you configured your settings to be secure.

Never use just default settings.

[–] i_am_not_a_robot@discuss.tchncs.de 6 points 1 day ago

The container thing is extremely unlikely. However, having worked with developers before, I know there are people who are running those AWS and Azure images with internet-facing SSH password authentication. If they hadn't already been hacked, they've all been hacked now. Somebody just had to check Shodan for hosts in those IP ranges running OpenSSH and try a few usernames.

[–] veniasilente@lemmy.dbzer0.com 9 points 2 days ago (1 children)

If I'm running containers on Alpine, doesn't that mean that they already don't offer SSH (sshd)? The entire point of Alpine as a base is to not add stuff you don't need.

load more comments (1 replies)
[–] tenchiken@anarchist.nexus 6 points 2 days ago

Everything behind a good firewall and proxy.

No public facing url should ever not be proxied.

Only ports you explicitly forward. Ever.

load more comments
view more: next ›