If you use openssh with musl without PAM and have password authentication enabled, there are two things you did wrong:
- having password authentication enabled
- using openssh
0 Boosts
1 Like
@toast but key authentication means that I need to have a private key stored on every client I want to access the server from, which is, in this day and age of "security? lmao what's security?", a trade-off worth pondering.
So I just got diverted onto a rapid security analysis of some code of mine that calls crypt() and that someone might have compiled against musl libc. Instead of what I was actually supposed to be doing this evening.
It turns out that as long as one passes in the password that one is actually checking, as is traditional usage for crypt(), the problem does not exist. Apart from that I didn't check for a NULL that traditionally is never returned, too. (-:
@ska How does one correct the latter and still have ssh access?
This federated comment is not yet available here.
passwords have no place on a server though wtf