in re: “SSHhole” (“log in to any account with no hash using a password that’s 1024 > n > 256 in length): two important notes:
to log onto root like demonstrated on the PoC page, you need PermitRootLogin, which is almost never set to
yes. The default isPermitRootLogin prohibit-password, which is what Alpine has been shipping with.Only root shipped without
!in the hash field. Every other account ships with!, so as far as I can tell, they were never vulnerable.
Verdict: NOTHINGBURGER AGAIN! There are valid reasons to enable ssh password auth, but if you’re allowing it for root, you’re just asking for trouble. Don’t Do That.
aside: i may be stupid, but my /etc/shadow.apk-new shows
root:::0:::::on a system that hasn’t been updated today. Notice the lack of the star.Is anything on sshhole dot com even real? Is this yet another case when someone is just spewing bullshit about a possible insecure configuration that has never actually been seen in the wild?