What an aSSHole!
this post was submitted on 06 Nov 2026
262 points (97.8% liked)
Technology
89506 readers
3089 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
Wait that means I have to expose a port. But I have zero exposed ports.
This post was created by the pangolin-gang.
practically need to rotate logs every hour if you foolishly leave ssh open on a open network. usually a bastion with ssh listening to port 34000 or such is a good first step.
that said the conditions for this exploit are fascinating. no pam, shadow password set to *, using a alternative to glibc. The sacrifices to be more efficient feel on par with replacing a tank's armor with paper mache and hope.
tldr: disable password auth in ssh.
Also name misses the point I think, it's a musl-hole.
Yeah, any application checking passwords would be vulnerable.
Further, OpenSSH using musl (pronounced muscle) must not use PAM (pluggable authentication modules),
which Alpine doesn't ship by default. Maybe one or the other remote administration suite depends on it, but those are often suspectible to exploits anyway. But you don't expose either to WAN, right?
The only time I ever exposed my SSH port to the WAN, I got about 750 connection attempts from China and 250 attemps from Russia per hour.
New friends from all over the world!
99.999% of that is over IPv4. I leave IPv6 open to WAN for my own use and it's not a problem.
yeah, while reading this i was going "What maniac exposes SSH to WAN anyway...?" the whole time. I fail to see any reason or point that can be justified exposing SSH to WAN.
I used to have a synology NAS that would sleep of death itself. Synology support asked me to port forward SSH to the open internet and set no password so they could pull logs over the next few weeks.
Yes, it was legit synology support not a scammer.
No, I haven’t bought synology ever again.
Any VPS provider just gives you an SSH IP and port. So that's the default state, until you do something else, which I imagine many don't, since key based authentication was always considered secure.
So I don't know the reason, but that's the standard practice with most providers, like Digital Ocean or Linode or whatever. You can call them maniacs but you shouldn't be surprised at something so ubiquitous.
Yeah it's crazy. Are they just constantly pinging every possible ip address on every possible port every second? I opened a port for 1 day and the traffic made me uncomfortable enough to rearchitecture my entire self host setup
Most ssh ports should be accessed through a VPN anyway, not exposed directly to the internet
Are you sure the VPN server has the smaller attack surface than the SSH server?
Wireguard and apps based on it (like Tailscale) don't respond at all unless the data is signed with the key of a configured peer (or with Tailscale, a system on your tailnet that passes the ACL). It's literally impossible for an outsider/attacker to detect with a port scan since it just ignores unauthenticated packets.
The Wireguard codebase is also extremely small. The core Wireguard implementation (the version in the Linux kernel) is around 5,000 lines long, so an experienced developer can read through all the code if they dedicate a day or two to it, and understand how it works.
For comparison, OpenVPN is around 70,000 lines of code and OpenSSH is around 150,000 lines of code. There's a huge number of features in SSH!
That is a convincing argument. I wasn't thinking of wireguard, but it makes sense that it's quite small and focused, being in the kernel.
I'm dealing more with OpenVPN and that can be very annoying, that had me lean in the opposite direction earlier (and lets not even speak of the Cisco crap).
Why aren't there more minimal implementations like tinyssh?
Because all those extra features are really useful. You can run all sorts of things over ssh, from sophisticated file transfer to remote development and tunneling
Ssh is remote code execution. Under any implementation, any authentication methods should be the absolute last line of defense after you've properly locked down access
Well, yeah but more features in remote code excution = more vulnerabilities. For example sftp: you could also just run ftp over vpn for the same effect. Or just cat the file over ssh. Instead, we have one big monolith. (same as with everything going over tcp)
OpenVPN, no. Wireguard, yes.
Given this is a vuln when entering the password, just turn off password auth and use ssh keys only. It's what you should be doing anyway.
Easier said than done.
If you have to support the sort of user that barely managed to download a copy of putty a few years ago and kept using this, then walking them through key generation and use is a nightmare.
One could fairly argue that maybe such people shouldn't have access to a system, but it is a reality.
Of course the likelihood that a system using musl is something that class of user would be accessing is lower.
Maybe now that ssh is generally "just there" for Windows users, you can more easily work with them to generate a key, or give them a zip file to make them have a key in a standard way. But the interaction of ssh and windows file security can be... Interesting, though mostly an issue on the ash server side.
The vuln is specifically for key-based accounts:
Second, the target system account must be configured to be passwordless. Passwordless accounts are commonly used for accounts that use certificate-based authentication.
"passwordless" here means that the account doesn't have a password. What the person you're replying to means is that password authentication should be completely disabled in the SSH config, as that's the only way to exploit this issue.
But passwords need to be enabled for SSH. You must submit a faulty password of a specific kind, and the SSH server misinterprets it for passwordless accounts, which means the server must be configured to allow you to attempt a password.
When logging into a passwordless account, the attacker can gain access by inputting more than 256 characters in the password field.
If you disable passwords in SSH, there is no password field. There is no way for you to input anything. The connection will just be refused as the only auth method is an ssh key. If there is no matching key, SSH will refuse the connection.
If you don't do that, the daemon will fall back to a password, which might then be vulnerable. However, no sane administrator would leave password auth enabled. Usually, you use the SSH password once - to copy an SSH key on the system. Then you disable it.
load more comments
(1 replies)
Can they please take a break from having vulnerabilities
nah, find and fix as many as possible.
It seems like the pattern emerging is that AI is great at finding these obscure vulnerabilities that are only exploitable on very particular systems with very particular, non-typical configurations, and only on nights where unicorns fart candycorn.
Sure, fix them, but the hype is too much. Also, disable password auth on SSH already. Jesus. Keys arnt that hard.
More like AI is much faster at finding obscure vulnerabilities, because it doesn't get tired of digging into the mind-numbing details of human-generated spaghetti code. Give a human the same kind of task, and they would die of boredom 12 hours into it.
We're entering an age where AI is quickly cleaning up the stupid security holes that have been created by decades of human mistakes, and will continue to be this way until increased AI security reviews will become more standard. The tribals wielding spears will continue to get shot by superior firepower until they adapt to the same weapons and protection themselves.
"Cleaning up" seems a little generous. It's finding them, but someone still has to patch them.
This example demonstrates my point though. It requires an extremely unusual system configuration that may or may not even exist in the real world it is so unusual. AI doesnt get tired, like you said, but its not about spaghetti code (both musl and openssh are gold-standard opposite of spaghetti code), its about trying every possible software combination in ways a human wouldnt bother.
Yeah and this isn’t a new paradigm, in the sense that tools to find exploits have gotten better repeatedly and allowed those with enough knowledge to use the tools to find them, regardless of if they could manually craft the exploit themselves. There’s a multitude of bug bounties that have been claimed by those who knew how to let a reverse engineering tool like ghidra hammer away at something with variation for long enough. And the models are capable of novel exploits on their own, but generally they are just doing the same, hammering ghidra with an MCP at accelerated scale. So “only ai would have found this bug” is technically untrue and moot.
load more comments
(8 replies)
Alpine? The one that doesn’t use glibc? Wasn’t this why they chose a different C runtime? For security. Ooops.
Dude. One issue in the time of how many in glibc...
Yes, one bug invalidates the whole project. As everyone knows, no bugs in glibc were ever discovered.
I feel like alpine is more well-known for being lightweight than secure
"Security" and getting rid of that pesky copyleft licensing in order to make it so corporate users have to give back as little as possible.
Fuck. OpenWRT might fit that bill.
Edit: it does, kind of:
https://forum.gl-inet.com/t/sshole-exploit-does-not-impact-gl-oem-firmware/72657
The person who discovered *sshole said OpenWRT is affected, but by default, that OS uses the Dropbear package, not OpenSSH, for SSH connections (though maintainers provide instructions for installing the latter).
view more: next ›