All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Critical security vulnerability affects OpenSSH on Alpine Linux systems
Version 10.6p2 of OpenSSH has been released with a workaround for a critical vulnerability that affects Linux systems that use musl libc with PAM disabled, such as Alpine Linux. OpenSSH developer Damien Miller said:
If you operate a Linux system that uses musl libc without PAM (Alpine Linux is one example) then stop reading and set PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY.
This vulnerability does not exist on non-Linux systems, Linux/glibc systems and Linux systems that use PAM for password authentication.
We consider the root cause of this bug to be outside OpenSSH itself, but we're in a good position to deliver a mitigation quickly.
The Alpine Linux project has announced that it will be backporting the OpenSSH fix "all the way back to Alpine 3.16", which was released in May 2022.
Comments
Fancy, finally something that theoretically affects me but who doesnt have "PasswordAuthentication no"? Concerning, lol
I do know a few people who actually mix password and keys.
I genuinely hope theyre bound to private ips then.
Although, i think there will be some instances of setups being highjacked. Cause yeah, during the install step you kinda do have the default setup and you would have PasswordAuthentication set to yes.
Alpine Linux is widely used for Docker deployments
Fuck
fresh deployments
ye but it would be highly unusual that it would have ssh in it. Although i reckon it could be a containerized ssh server for whatever reason.
A fun one, https://sshhole.com/
man, wanted to test it. Turns out, the openwrt i installed on that tp-link comes with dropbear. Now i have to deploy some machine to see that for myself
@backtogeek, with your sweet 128M Alpines, fyi
(Don't have one running now to check whether it uses dropbear or openssh in the images)
interesting. ive booted a livecd of 3.22.0 and setting up ssh there with the default, doesnt let me in.
Edit: yeah doesnt seem to work. How odd. Ive done it twice now, making absolutely sure it cant pull any updates and installs from the disk image but i cant get in with the 300 char password, keeps throwing "Permission denied (publickey,password,keyboard-interactive)."
Edit Edit: seems like you have to do some really stupid shit to even trigger it. wow.
Edit Edit Edit:
Holyfuck. openwrt did do it. WOW. A default alpine install doesnt do that. Thank fuck openwrt used dropbear on that tp-link
So lately I've been feeling that devs were eventually lazy causing ai to be slop
Rude to call me out like that.
Maybe I know more than a few
dropbear has always been working well.
panicked but realized I use dropbear everywhere
Alpine always needed more love
Sad to see musl lib as the likely culprit. Any info on the relevant source code?
I'm glad though to run my Alpine servers with public key only (plus a few extra precautions).
Thanks for the info @tentor!
I am not sure if it is musl fault or openssh bug, see https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482
delete
musl has a smaller attack surface but the community scrutiny it gets is also much smaller, it's safer to stick with glic
In glibc bug discovery is proactive while in musl, for lack of resources, it is reactive. Google and Red Hat are heavily invested in glibc.
The bigger the project, the harder it is to actually act proactively, and I do not believe in absolute proactiveness being possible either.
That is not a plus but a concern for me, sorry.