Critical security vulnerability affects OpenSSH on Alpine Linux systems

tentor

Version 10.6p2 of OpenSSH has been released with a workaround for a critical vulnerability that affects Linux systems that use musl libc with PAM disabled, such as Alpine Linux. OpenSSH developer Damien Miller said:

If you operate a Linux system that uses musl libc without PAM (Alpine Linux is one example) then stop reading and set PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY.

This vulnerability does not exist on non-Linux systems, Linux/glibc systems and Linux systems that use PAM for password authentication.

We consider the root cause of this bug to be outside OpenSSH itself, but we're in a good position to deliver a mitigation quickly.

The Alpine Linux project has announced that it will be backporting the OpenSSH fix "all the way back to Alpine 3.16", which was released in May 2022.

Mainfrezzer

Fancy, finally something that theoretically affects me but who doesnt have "PasswordAuthentication no"? Concerning, lol

tentor

@Mainfrezzer said:
Fancy, finally something that theoretically affects me but who doesnt have "PasswordAuthentication no"? Concerning, lol

I do know a few people who actually mix password and keys.

Mainfrezzer

@tentor said:

@Mainfrezzer said:
Fancy, finally something that theoretically affects me but who doesnt have "PasswordAuthentication no"? Concerning, lol

I do know a few people who actually mix password and keys.

I genuinely hope theyre bound to private ips then.

Although, i think there will be some instances of setups being highjacked. Cause yeah, during the install step you kinda do have the default setup and you would have PasswordAuthentication set to yes.

Mynymbox

Alpine Linux is widely used for Docker deployments

rpqu

Fuck

Roxyrex

@Mainfrezzer said:
Fancy, finally something that theoretically affects me but who doesnt have "PasswordAuthentication no"? Concerning, lol

fresh deployments

Mainfrezzer

@Mynymbox said:
Alpine Linux is widely used for Docker deployments

ye but it would be highly unusual that it would have ssh in it. Although i reckon it could be a containerized ssh server for whatever reason.

glueckself

A fun one, https://sshhole.com/

Mainfrezzer

man, wanted to test it. Turns out, the openwrt i installed on that tp-link comes with dropbear. Now i have to deploy some machine to see that for myself

glueckself

@backtogeek, with your sweet 128M Alpines, fyi
(Don't have one running now to check whether it uses dropbear or openssh in the images)

Mainfrezzer

interesting. ive booted a livecd of 3.22.0 and setting up ssh there with the default, doesnt let me in.

Edit: yeah doesnt seem to work. How odd. Ive done it twice now, making absolutely sure it cant pull any updates and installs from the disk image but i cant get in with the 300 char password, keeps throwing "Permission denied (publickey,password,keyboard-interactive)."

Edit Edit: seems like you have to do some really stupid shit to even trigger it. wow.

Edit Edit Edit:

Holyfuck. openwrt did do it. WOW. A default alpine install doesnt do that. Thank fuck openwrt used dropbear on that tp-link

woinokiz

So lately I've been feeling that devs were eventually lazy causing ai to be slop

kait

@tentor said: I do know a few people who actually mix password and keys.

Rude to call me out like that.

tentor

@kait said:

@tentor said: I do know a few people who actually mix password and keys.

Rude to call me out like that.

Maybe I know more than a few

ehab

dropbear has always been working well.