The SSH Bug That Made ANY 300-Character Password Valid

SSHole Vulnerability

The video explains SSHole, a vulnerability affecting certain OpenSSH configurations on musl-based Linux systems, notably Alpine Linux.

Under the conditions described, a password longer than 256 bytes could cause the password-hashing function to return *, a marker normally used for an invalid or locked password. OpenSSH could then mistakenly treat that result as a valid match during authentication, allowing a login that should have been rejected.

How the issue occurred

The vulnerability depended on several behaviors combining:

• musl was changed to return * for certain hashing errors, and oversized passwords could trigger such an error.
• OpenSSH performed dummy password checks for accounts without usable passwords to help prevent username-enumeration timing attacks.
• Alpine configurations could have PAM disabled and use * in /etc/shadow to block password logins while still allowing SSH-key logins.

The speaker says some internet-accessible Alpine servers were vulnerable, particularly when SSH password authentication was enabled. They also warn that Alpine’s default user may have passwordless doas privileges, potentially increasing the impact of a compromise.

Fixes and Practical Guidance

• Upgrade to a fixed OpenSSH package. The video cites OpenSSH 10.6p2 and says Alpine backported the fix to older packages. It recommends updating with apk upgrade.
• Where appropriate, configure SSH to accept key-based logins only. Restart the SSH daemon after changing its configuration.
• Audit Alpine servers and embedded systems that expose SSH to the internet.
• The video notes that the minimal Alpine image commonly used as a Docker base generally has no SSH server or client, so it is not affected in that form.

Additional Context

The video provides background on /etc/passwd and /etc/shadow, the use of * to mark unusable password hashes, and the history of changes that combined to create the bug. It also describes a researcher using AI agents to test many OpenSSH builds and login cases, reportedly trying more than 17,000 variations.

Speakers and Sources

• Mental Outlaw — narrator and analyst.
• The researcher behind sshole.com — credited with discovering and reporting the issue; the video references the researcher’s write-up.
• OpenSSH and Alpine Linux developers — referenced in connection with the fix and package updates.