Alpine Linux has issued a security advisory regarding a vulnerability in its `openssh-server` package that allows an attacker to bypass password authentication. The flaw affects systems where OpenSSH is built without Pluggable Authentication Modules (PAM) or where the `UsePAM` setting is disabled. Under these conditions, an attacker who can reach the SSH port can log into any account whose password field is set to `*` (a common configuration for key-only accounts) without knowing a password. This bypass works consistently in a single connection and requires no retries.
The technical root of the issue lies in the interaction between OpenSSH and the `musl` C library. When `sshd` is built without PAM, it validates passwords by hashing the attempt using the `crypt()` function and comparing it to the stored password field. If an account's stored field is too short to contain a salt, `sshd` borrows the salt from another account on the system. Because the `musl` library's `crypt()` function returns `*` as an error indicator when a password exceeds 256 bytes, an attacker providing a string between 257 and 1024 bytes triggers this error. Since `*` is also the exact value stored for accounts with no password, the system incorrectly validates the login as successful.
This vulnerability affects a wide range of Alpine Linux releases, including versions 3.16 through 3.24 and the 'edge' branch. Specifically, it impacts systems where `PasswordAuthentication` is enabled and at least one other local account possesses a standard `$5$` or `$6$` password hash. To remediate the issue, Alpine recommends upgrading to the fixed package versions (such as 3.21.10, 3.22.8, 3.23.8, or 3.24.4) and restarting the `sshd` daemon. Alternatively, users can close the security hole by setting `PasswordAuthentication no` in their SSH configuration. Users are advised to check `/var/log/messages` for 'Accepted password' entries for accounts that should only allow key-based access to determine if a compromise has occurred.