Discussion
Okay, was anyone actually able to replicate the musl/openssh bug? I've had no luck with Alpine 3.20.10.
/etc/shadow, last two lines:
test:*:20762:0:99999:7:::
q3k:$6$snip.GgDQNTrqqX.A0:20762:0:99999:7:::
I have UsePAM no and PasswordAuthentication yes in my sshd_config. I try to ssh test@, first with a wrong password, then with 'A' * 300, but no dice.
Is this bug actually real?
Yeah, okay, had to downgrade OpenSSH (by building an old version) and then this works quite well:
$ ssh test@192.168.122.70
test@192.168.122.70's password:
Permission denied, please try again.
test@192.168.122.70's password:
Welcome to Alpine!
[snip]
alpine320:~$
Neat!
@q3k time for another https://pavursec.com/blog/stealmybitcoin/
@q3k set password needs to use a sha512 hash
alsp login attempt needs to go to user with password *
@leah Both are true for me (sha512 is the default passwd alg so q3k has a sha512 hash, I was SSHing into test@ which has *)
Do you try very long bad password?
I cannot test - no Alpine - but see this:
https://sshhole.com
@q3k i need to learn to read ><
Oh, I think Alpine just ninja-updated openssh for EOL versions, too? And it updates during installation from CD?
I have openssh-9.7_p1-r6. That seems patched.