>here's your open source bro, enjoy your superior security>https://sshhole.com
I already have a working SSH feed bud if you're going to make a thread at least say something of importance related to the subject.
>requires ssh compiled with musl>requires not using pam>requires password loginsanother nothingburger from the ai schizos
>>110250298I was interested because it sounds like an ssh problem rather than a musl problem, but that's not true. Not quite a lie, but the cynic in me thinks it was supposed to be interpreted that way
>>110250361>SSH feedwtf is a ssh feed?do you indians even proof read the regurgitated gpt slop you paste here?
>>110250361>SSH feedRSS*** feed lol
See, that's why you should always change your SSH port or you will get hacked instantly. Also don't forget to hide your SSID.
>>110250298Shitty baitYou want a link to https://learn.microsoft.com/en-us/security-updates/ with that?
i run alpine 3.23/etc/shadow contains ! (this fag's assertion that it's * is false)pam is on (because i'm not a retard)the exploit didn't worki sleep
>>110250524>Shitty baithttps://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/you are mentally ill.
my aruba ap-105 running openwrt on 25.12.5 isn't letting me login on root with a 257 char password though, how can I replicate?
is this bad im nooob
>>110250559Nothingburgerhttps://news.ycombinator.com/item?id=50380029
>>110250410It's just like the xz utils fiasco actually being a systemd problem. Mentioning that anywhere will get loser SV retards throwing a tantrum though.
Lol absolutely shitcoded
>>110250578>no, dont read stuff from people who ship that linux. instead read trannies opinions. fuck off retard.
>>110250298Another bug caused by unix plaintext retardation. Imagine returning "*" on error. Should have been an Option<String>. It's way past time we abandon unixslop.
>>110250560Doesn't OpenWRT use dropbear instead of openssh?
>>110250376spbp /thread
>>110250714you're right
>>110250298>Title says *sshole>URL is sshhole
>>110251318yes.
>>110251318you can't put asterisk in a domain name
>>110250298Why do people use ssh when nc -e exists?
nc -e
>allowing ssh open to the public internetwhy would you do this, ever, for any reason
>>110251402you should be able to
>>110251576
>>110251576because I'm lazy, there's nothing worth hacking on my VPS and pubkey auth just works.next question
>>110251616>because I'm lazy,so am i, and even i use wireguard or some other bullshit, ask your clanker to do it for you
openwrt uses dropbear unless you replace it
>>110251622bugs in wireguard could lead to much worse consequences because it runs in the fucking kernel, openssh is tried and tested, if you follow the best security practices it's the safest option
>>110250298>musllol
>>110250298>musl is insecure garbageGNU bros, we can't stop winning
what an awful site
>>110250298GNU Gods win yet again.
>>110250298>sets up a whole website for a nothingburger excuse of a bugthese people are crazy
>>110251402They could put an a instead
ssh is oldschool I simply ask Claude to run the command and send back the output
Rust's `Result<T>` would have prevented it.
braphole security lol
>For an account whose stored field is too short to contain a salt (the random prefix of a hash), sshd borrows the salt of another account.>musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long. * is also exactly what the stored field contains for every account with no password, so the “hash” matches and the login succeeds.what in tarnation, birthday paradox where 2 separate niggers press the same button, except one is thinking shieee and the other one chicken
>>110250298>nooooo noooooooo its fake noooooooooooo
>>110250298so this is a problem on a package version only on a specific irrelevant linux distro? why was it not updated to upstream?
>>110252622no, it's only a problem if you don't use pam, have an account with password hash "*", have another account with salted password hash, and use musl libc
>>110250376>>requires ssh compiled with muslHow many musl distros are even out there?Alpine, Gentoo and the inferior arch linux copycat void?And literally who is out there not using fucking pam on their computer?
>>110252815to be fair, PAM is bloat.
>>110250376All hour assumptions are correct, but here comes a fuckload of docker containers and you'te not going to believe this, but guess who's got a root user with a password?
>>110252865>running dockerSounds like you get what you fucking deserve.
>>110252865who tf uses ssh in a container
>>110250298>requires password authenticationyawn. If you still have password authentication enabled in your SSH server then you deserve to get hacked.
