Nine-year OpenSSH bug on musl Linux: passwords over 256 chars unlock locked accounts
TheZachMueller · x · 2026-11-05
sshhole.com details an OpenSSH issue present since 2016 on musl-based systems (Alpine, OpenWrt, many Docker images): accounts that should never accept passwords (root, key-only deploy users, LDAP users) can log in with any password longer than 256 characters. The root cause traces through Unix history: Bill Joy's 1980 sentinel in /etc/passwd, the 1997 spec saying crypt() returns NULL on failure, programs that never check NULL, and musl's 2012 decision to return a single character instead—letting oversized passwords bypass authentication.
More from Infra
- WSJ: OpenAI leaders weigh resetting data center expectations amid AI bubble worries — SumitGup · 2026-11-05
- Hob: free open-source local AI app that reads docs and fills PDFs fully offline — Div_pradeep · 2026-11-05
- Vertex AI users report Google secretly breaking KV cache, driving up token bills — niwatoriking · 2026-11-05
- Building a $2,000 CAD ComfyUI PC: used RTX 3090 24GB vs newer GPUs? — Good_Business7425 · 2026-11-05
- OpenAI reportedly to cover full power costs of future data centers — inductionheads · 2026-11-05
- Dropbox acquires Tigris Data for $350M to bolster its AI infrastructure — TechCrunch AI · 2026-11-05