According to Schneier on Security, a significant security vulnerability affecting OpenSSH and musl-based Linux distributions has been identified. Dubbed “sshole,” this flaw allows attackers to bypass authentication mechanisms on systems that have explicitly disabled password logins. The issue stems from a long-standing defect that has remained in the codebase for approximately a decade, potentially exposing numerous servers to unauthorized access without proper credentials.
The core of the problem lies in how the SSH daemon handles password inputs on specific operating environments. While many Linux distributions enforce strict authentication policies, systems running on musl libc, such as Alpine Linux, are particularly susceptible. When an attacker submits a password string that exceeds standard length limits, the system fails to reject the oversized input correctly. Instead of denying access due to the invalid format or the disabled password policy, the authentication process erroneously grants entry. This bypass effectively circumvents security controls designed to prevent password-based logins, turning a disabled feature into an active entry point for malicious actors.
Implications for system administrators are severe. Since the flaw relies on basic input handling rather than complex cryptographic breaks, it is relatively easy to exploit. Any server configured with password authentication disabled but still running OpenSSH on a musl-based environment is at risk. The persistence of this bug for ten years suggests that standard validation routines may have overlooked edge cases in input length processing. Organizations relying on these configurations must urgently review their SSH service settings and apply available patches. Failure to address this vulnerability could result in unauthorized data access, as attackers can simply use excessively long passwords to gain shell access despite security policies intended to block such methods.
