--- title: OpenSSH flaw lets attackers log into password-disabled... description: A newly disclosed OpenSSH flaw called '*sshole' lets attackers log into musl-based Linux accounts that have password authentication disabled, just by... canonical: https://daily.dev/posts/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts-dl8tlxq4t twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: OpenSSH flaw lets attackers log into password-disabled Linux accounts | daily.dev og:description: A newly disclosed OpenSSH flaw called '*sshole' lets attackers log into musl-based Linux accounts that have password authentication disabled, just by... og:url: https://daily.dev/posts/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts-dl8tlxq4t og:image: https://api.daily.dev/og/posts/Dl8TlXQ4T.png og:image:alt: OpenSSH flaw lets attackers log into password-disabled Linux accounts og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # OpenSSH flaw lets attackers log into password-disabled Linux accounts **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary A newly disclosed OpenSSH flaw called '*sshole' lets attackers log into musl-based Linux accounts that have password authentication disabled, just by submitting an oversized password. It affects Alpine Linux, OpenWrt, Buildroot, and Yocto systems where PAM authentication is off and at least one account uses an asterisk as its password hash. The musl crypt() function returns '*' when a password exceeds its 256-byte limit, causing OpenSSH to match it against the stored '*' and grant access. Alpine's official AWS and Azure cloud images could allow attackers to gain root access through the default 'alpine' account, which has passwordless 'doas' privileges. The bug dates to a 2016 patch and is fixed in OpenSSH 10.6p2; admins can mitigate it by setting 'PasswordAuthentication no'. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why can someone log into my Alpine Linux account even though I disabled its password with an asterisk in /etc/shadow? A flaw dubbed '*sshole' affects OpenSSH on musl-based systems like Alpine Linux, OpenWrt, Buildroot, and Yocto. The musl crypt() function returns '*' when a submitted password exceeds its 256-byte limit, so an oversized password matches the account's stored '*' hash and succeeds. It requires PAM disabled, password authentication enabled, and another account with a valid password hash. _Teams hardening SSH on musl-based servers follow vulnerability breakdowns like this on daily.dev._ ### How do I fix the OpenSSH musl password bypass vulnerability on Alpine Linux? Update OpenSSH to version 10.6p2 using 'apk upgrade openssh' on Alpine Linux. If an immediate update isn't possible, mitigate by setting 'PasswordAuthentication no' in the SSH server configuration and restarting SSH, which disables password logins entirely and closes the exploit path. _Admins patching SSH configs can track fixes like this one on daily.dev before attackers find them first._ ### Is my Debian or Ubuntu server vulnerable to the OpenSSH *sshole bug? No, systems using glibc, including Debian, Ubuntu, and Fedora, are not vulnerable to this attack. The flaw only affects OpenSSH servers on Linux distributions using the musl C library, such as Alpine Linux, OpenWrt, Buildroot, and Yocto, and only when PAM authentication is disabled. _Sysadmins triaging which distros need urgent patching rely on clear scope details like this via daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts-dl8tlxq4t) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"OpenSSH flaw lets attackers log into password-disabled Linux accounts","url":"https://daily.dev/posts/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts-dl8tlxq4t","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts-dl8tlxq4t"},"datePublished":"2026-11-05T17:46:59.348Z","dateModified":"2026-11-05T21:43:06.843Z","description":"A newly disclosed OpenSSH flaw called '*sshole' lets attackers log into musl-based Linux accounts that have password authentication disabled, just by...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/852efca43b3e75eecd8a49b97456c108?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/852efca43b3e75eecd8a49b97456c108?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts-dl8tlxq4t","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ssh","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"OpenSSH flaw lets attackers log into password-disabled Linux accounts"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts-dl8tlxq4t#faq","mainEntity":[{"@type":"Question","name":"Why can someone log into my Alpine Linux account even though I disabled its password with an asterisk in /etc/shadow?","acceptedAnswer":{"@type":"Answer","text":"A flaw dubbed '*sshole' affects OpenSSH on musl-based systems like Alpine Linux, OpenWrt, Buildroot, and Yocto. The musl crypt() function returns '*' when a submitted password exceeds its 256-byte limit, so an oversized password matches the account's stored '*' hash and succeeds. It requires PAM disabled, password authentication enabled, and another account with a valid password hash. Teams hardening SSH on musl-based servers follow vulnerability breakdowns like this on daily.dev."}},{"@type":"Question","name":"How do I fix the OpenSSH musl password bypass vulnerability on Alpine Linux?","acceptedAnswer":{"@type":"Answer","text":"Update OpenSSH to version 10.6p2 using 'apk upgrade openssh' on Alpine Linux. If an immediate update isn't possible, mitigate by setting 'PasswordAuthentication no' in the SSH server configuration and restarting SSH, which disables password logins entirely and closes the exploit path. Admins patching SSH configs can track fixes like this one on daily.dev before attackers find them first."}},{"@type":"Question","name":"Is my Debian or Ubuntu server vulnerable to the OpenSSH *sshole bug?","acceptedAnswer":{"@type":"Answer","text":"No, systems using glibc, including Debian, Ubuntu, and Fedora, are not vulnerable to this attack. The flaw only affects OpenSSH servers on Linux distributions using the musl C library, such as Alpine Linux, OpenWrt, Buildroot, and Yocto, and only when PAM authentication is disabled. Sysadmins triaging which distros need urgent patching rely on clear scope details like this via daily.dev."}}]} ```