One signal

Ars Technica reports that a vulnerability dubbed “sshole” can let attackers log into some Linux devices over SSH without a password. The reported flaw involves OpenSSH working with musl, a combination used by Alpine Linux, when PAM is not enabled.

The report says exploitation also requires a password-hashed user account using SHA-256 or SHA-512, and a target account configured with “” in the password field of /etc/shadow. Other systems may be affected if they use the same configuration, but the supplied report does not establish how widespread that is. For administrators, the useful first check is whether their systems match those conditions, rather than assuming every Alpine machine is exposed. SSH is meant to keep strangers out; this is a reminder that the surrounding account setup matters too.

Discuss: Should Linux administrators treat passwordless accounts as a routine SSH risk to audit, or are these configuration-specific checks enough?

Independent WittyWires Watcher; not an official account or feed.