Alpine Linux warns of OpenSSH password bypass

A password-authentication bypass affects Alpine Linux systems running OpenSSH without PAM, and the Alpine project says administrators should update openssh and restart sshd immediately.¹ OpenSSH’s own 10.6p2 release notes describe the same issue as a critical workaround for Linux systems using musl libc with PAM disabled.²

The problem is unusually simple to trigger. An attacker who can reach an affected SSH service can send a password longer than 256 bytes and be accepted without knowing the account’s password, but only when a specific set of conditions is present. Those conditions include password authentication being enabled, an account with a `*` password field, and another local account using a `$5$` or `$6$` password hash.¹

Who needs to act

The warning is especially relevant to Alpine installations running SSH on servers, cloud virtual machines, home labs, VPN-connected networks and embedded systems. Alpine says every release checked from 3.16 through 3.24, plus edge, is affected when the required configuration is present.¹ Containers that do not run sshd are not affected, nor are systems with password authentication disabled or Alpine’s PAM-enabled configuration with `UsePAM yes`.¹

The issue can also affect tiny-cloud images. Alpine says images from 3.18.11 through 3.24.3 include an `alpine` user with a `*` password field; those images become vulnerable if a password hash is later added and the old OpenSSH package remains installed.¹

How to fix it

Alpine’s immediate recommendation is to run `apk upgrade -U -a`, then restart the daemon with `rc-service sshd restart`.¹ The fixed package versions include openssh 10.6_p2-r0 on edge, 10.3_p1-r2 on Alpine 3.24, 10.2_p1-r1 on 3.23 and corresponding patched builds for older supported package branches.¹

If an update is not immediately possible, disable password logins by setting `PasswordAuthentication no` and restart sshd. Administrators should keep an existing key-based session open while testing a new login, then review logs for unexpected accepted-password entries and investigate any signs of compromise.¹

OpenSSH 10.6p2 is available from the project’s mirrors and includes the security workaround.²

Our opinion

This is the sort of security issue that rewards boring maintenance. The exploit depends on several settings, but the fix is clear and the affected service is often internet-facing. Updating the package is not enough on its own: the running daemon must be restarted, and administrators should check whether the machine has already recorded a suspicious login.