*sshole · sshhole.com
sshhole.com
openssh on musl linux has been letting people into password-less accounts since 2016.
  • RedSnt ♾️🦋♂️👓🖥️🐧@feddit.dkEnglish
    1·
    2 minutes ago
    I have 4 accounts on my OpenWRT router with * as their password, but I did try with a random password over 256 characters and I couldn't log into them. 
    daemon:*:1:1:daemon:/var:/bin/false
ftp:*:55:55:ftp:/home/ftp:/bin/false
network:*:101:101:network:/var:/bin/false
nobody:*:65534:65534:nobody:/var:/bin/false

    Still, this is a huge security flaw!

  • everett@lemmy.ml
    3·
    28 minutes ago

    openssh on musl linux (alpine, openwrt, buildroot, yocto, and a lot of the docker images you’ve pulled)