>here's your open source bro, enjoy your superior security>https://sshhole.com
I already have a working SSH feed bud if you're going to make a thread at least say something of importance related to the subject.
>requires ssh compiled with musl>requires not using pam>requires password loginsanother nothingburger from the ai schizos
>>110250298I was interested because it sounds like an ssh problem rather than a musl problem, but that's not true. Not quite a lie, but the cynic in me thinks it was supposed to be interpreted that way
>>110250361>SSH feedwtf is a ssh feed?do you indians even proof read the regurgitated gpt slop you paste here?
>>110250361>SSH feedRSS*** feed lol
See, that's why you should always change your SSH port or you will get hacked instantly. Also don't forget to hide your SSID.
>>110250298Shitty baitYou want a link to https://learn.microsoft.com/en-us/security-updates/ with that?
i run alpine 3.23/etc/shadow contains ! (this fag's assertion that it's * is false)pam is on (because i'm not a retard)the exploit didn't worki sleep
>>110250524>Shitty baithttps://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/you are mentally ill.
my aruba ap-105 running openwrt on 25.12.5 isn't letting me login on root with a 257 char password though, how can I replicate?
is this bad im nooob
>>110250559Nothingburgerhttps://news.ycombinator.com/item?id=50380029
>>110250410It's just like the xz utils fiasco actually being a systemd problem. Mentioning that anywhere will get loser SV retards throwing a tantrum though.
Lol absolutely shitcoded
>>110250578>no, dont read stuff from people who ship that linux. instead read trannies opinions. fuck off retard.
>>110250298Another bug caused by unix plaintext retardation. Imagine returning "*" on error. Should have been an Option<String>. It's way past time we abandon unixslop.
>>110250560Doesn't OpenWRT use dropbear instead of openssh?
>>110250376spbp /thread
>>110250714you're right
>>110250298>Title says *sshole>URL is sshhole
>>110251318yes.
>>110251318you can't put asterisk in a domain name
>>110250298Why do people use ssh when nc -e exists?
nc -e
>allowing ssh open to the public internetwhy would you do this, ever, for any reason
>>110251402you should be able to
>>110251576
>>110251576because I'm lazy, there's nothing worth hacking on my VPS and pubkey auth just works.next question
>>110251616>because I'm lazy,so am i, and even i use wireguard or some other bullshit, ask your clanker to do it for you
openwrt uses dropbear unless you replace it
>>110251622bugs in wireguard could lead to much worse consequences because it runs in the fucking kernel, openssh is tried and tested, if you follow the best security practices it's the safest option
>>110250298>musllol
>>110250298>musl is insecure garbageGNU bros, we can't stop winning
what an awful site
>>110250298GNU Gods win yet again.
>>110250298>sets up a whole website for a nothingburger excuse of a bugthese people are crazy
>>110251402They could put an a instead
ssh is oldschool I simply ask Claude to run the command and send back the output
Rust's `Result<T>` would have prevented it.
braphole security lol
>For an account whose stored field is too short to contain a salt (the random prefix of a hash), sshd borrows the salt of another account.>musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long. * is also exactly what the stored field contains for every account with no password, so the “hash” matches and the login succeeds.what in tarnation, birthday paradox where 2 separate niggers press the same button, except one is thinking shieee and the other one chicken
>>110250298>nooooo noooooooo its fake noooooooooooo
>>110250298so this is a problem on a package version only on a specific irrelevant linux distro? why was it not updated to upstream?
>>110252622no, it's only a problem if you don't use pam, have an account with password hash "*", have another account with salted password hash, and use musl libc
