this post was submitted on 05 Nov 2026
260 points (96.4% liked)

Selfhosted

63678 readers
670 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
260
Check if you need to update all your stuff - again. (sshhole.com)
submitted 3 days ago* (last edited 3 days ago) by smiletolerantly@awful.systems to c/selfhosted@lemmy.world
92 comments fedilink hide all child comments
 

are you affected?

  • is your sshd running on musl? (alpine, openwrt, buildroot, yocto)
  • is it not using pam? alpine's openssh-server doesn't by default, or maybe you set UsePAM no
  • are password logins still on? they are by default
  • is there an account with just * as its password? key-only users, ldap users, root on alpine
  • and some other account with a real password?
  • then that * account takes any password between 257 and 1024 characters

on alpine's official aws and azure images that's the default alpine user, and it has passwordless doas. so it's root

on debian, ubuntu, fedora or anything else with glibc? going through pam? dropbear? openbsd? you're fine

top 50 comments
sorted by: hot top controversial new old
[–] panda_abyss@lemmy.ca 66 points 3 days ago* (last edited 3 days ago) (2 children)

Jesus Christ. Why?! How?

Edit: I can't figure out how to upload gifs to Lemmy... please imagine castle-nathan.gif

[–] NoLemurs@lemmy.world 23 points 3 days ago (3 children)

castle-nathan.gif

I don't know why, but I always assumed that image was from Firefly. It's the same color shirt and everything!

[–] bjoern_tantau@swg-empire.de 9 points 3 days ago (1 children)

Didn't he dress up as a "space cowboy" in one episode?

[–] lka1988@lemmy.dbzer0.com 8 points 3 days ago

There are a lot of references to Firefly in Castle. It's quite entertaining.

load more comments (1 replies)
[–] Vittelius@feddit.org 7 points 3 days ago

I can't figure out how to upload gifs to Lemmy...

![alt text - optional, you can keep this empty, but you need the brackets](https://website.tld/castle-nathan.gif)

[–] tal@lemmy.today 41 points 3 days ago

did you get hacked? check.

$ grep "Accepted password" /var/log/messages

That's a really bad check unless you have an external box receiving logs and you're looking there, because the first thing that a sophisticated attacker is going to do if they get in as root is remove the signs of their presence.

[–] possiblylinux127@lemmy.zip 36 points 3 days ago

This isn't nearly as bad as I thought it was. Also the author is very reliant on AI to the point where they didn't think about what if someone wipes the logs.

Any effected devices should be wiped and redeployed

[–] HCSOThrowaway@lemmy.world 34 points 3 days ago* (last edited 3 days ago) (4 children)

I'm no cybersecurity expert, but from what I've heard from those who are, this is the new normal as anyone who formerly had no chance due to being a "script kiddie" can now just prompt an AI* to eventually find a vulnerability.

* oversimplification redacted

[–] colourlesspony@pawb.social 17 points 3 days ago (1 children)

Yep, those new fangled slop-kitties. The worst part is that there brute force hacking is being subsidized by people 401ks.

[–] HCSOThrowaway@lemmy.world 6 points 3 days ago* (last edited 3 days ago)

The irony - of course - is that their 401k money goes right into hacking those same people's 401ks.

... but at least we can brainrot an entire generation with glass fruit slices and put artists out of work?

Now if you'll excuse me, I have to go convince someone that the TikTok deepfakes they're watching aren't real and that cops don't really employ nanny-boo-boos to unsettle criminals during interrogations. No, I'm not joking.

[–] lemmyvore@feddit.nl 11 points 3 days ago (1 children)

It's not quite as simple as that. The author in this case followed a pretty specific trail to find the bug.

Where AI helped was as the last step. They already knew what the bug would do and where to look, but actually looking through the source code for all the possible musl implementations out there would have taken a lot of time.

So they brute-forced it instead and asked AI to spin up actual running instances of all those implementations and simply tried the bug against each of them, rather than looking at all the code.

[–] HCSOThrowaway@lemmy.world 5 points 3 days ago* (last edited 3 days ago) (1 children)

Fair enough, but the overall idea stands:

The bar has been significantly lowered for what it takes to hack.

[–] lemmyvore@feddit.nl 8 points 3 days ago* (last edited 3 days ago) (6 children)

That's because it turns out there are tons of vulnerabilities out there introduced by very lazy and/or dumb code.

It isn't that AI has lowered the bar for hacking, it's that it's showing us just how much bad code is out there. The bar was already on the ground, we just didn't know it.

After all is said and done AI will actually end up raising the bar for security everywhere.

Unfortunately we have a lot of legacy crap to clean first.

load more comments (6 replies)
[–] hirihit640@sh.itjust.works 6 points 3 days ago* (last edited 3 days ago)

You'd think that but so far I haven't seen an actual PoC exploit for the PHP vulnerability that doesn't require misconfiguring the server. And this is over a week after the patches were released.

load more comments (1 replies)
[–] tofu@lemmy.nocturnal.garden 35 points 3 days ago (5 children)

I mean, not that it's not severe, but which container images have ssh baked in? If you're using good stripped down images, you're fine here.

Not sure where the overlap is between"ssh is enabled" and "one of those OSes". LXCs maybe?

[–] ikidd@lemmy.dbzer0.com 23 points 3 days ago* (last edited 3 days ago) (1 children)

SSH enabled and the SSH port of the container accessible and it's set for password auth.

load more comments (1 replies)
[–] HelloRoot@lemy.lol 7 points 3 days ago (6 children)

Maybe something like git forges and gist alternatives?

[–] possiblylinux127@lemmy.zip 5 points 3 days ago

They use key based authentication

load more comments (5 replies)
[–] Samsy@lemmy.ml 5 points 3 days ago (4 children)

Linux phones? PostmarketOS is alpine-based. And a lot of people may ssh to their phone.

[–] KaninchenSpeed@lemmy.blahaj.zone 2 points 1 day ago* (last edited 1 day ago)

checked on my phone, there are a few system users with !* as their password, from what i can tell ! blocks all logins and is not bypassed by this exploit, but their shell is set to /sbin/nologin anyways.

The default firewall rules of nura block ssh from mobile data, so only wifi and usb connections would be affected if at all.

Everyone should disable ssh password auth anyways, using the phones often short pin for ssh is not secure.

load more comments (3 replies)
load more comments (2 replies)
[–] tapdattl@lemmy.world 21 points 3 days ago (12 children)

I'm assuming this is only if you allow password authentication? If you're only allowing certificate based auth you should be safe, right?

[–] chameleon@fedia.io 24 points 3 days ago

Correct, password authentication must be enabled on the SSH daemon side of things to be vulnerable. The user account being logged into, on the other hand, can't have a password set. But overall, PW auth must be on. The website OP linked is exceedingly bad at explaining the actual problem, see Alpine's announcement for better info.

https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/

load more comments (11 replies)
[–] rtxn@lemmy.world 20 points 3 days ago* (last edited 3 days ago) (2 children)

That website is atrocious. It's the web design equivalent of shoving five kilograms of sugar and whipped cream in a cup of coffee.

[–] tal@lemmy.today 18 points 3 days ago (2 children)

Now, now. Starbucks is a very successful business.

load more comments (2 replies)
[–] lagoon8622@sh.itjust.works 5 points 3 days ago

"Cyber" ppl love to do this. This is basically their resume I guess? They have to sensationalize absolutely everything they can (not that this isn't an important bug, but this could have been a 1-2 page white paper imo (like many of them))

[–] lntl@lemmy.ml 12 points 3 days ago

I wouldn't recommend deploying any ssh server without reviewing the config and believe sane defaults are sane.

[–] Orygin@sh.itjust.works 12 points 3 days ago (1 children)

OP I know you're trying to do good, but please try to understand the vulnerability before spreading FUD

load more comments (1 replies)
[–] qaz@lemmy.world 12 points 3 days ago (1 children)

Most containers don't run ssh right?

[–] lemmyvore@feddit.nl 6 points 3 days ago

Unless it's explicitly installed no. The default Alpine image doesn't come with OpenSSH.

[–] danielquinn@lemmy.ca 8 points 3 days ago (2 children)

I've been setting UsePam = no for decades because leaving it on meant that it'd still present a password login of keys failed. Is this still the case, was I wrong from the beginning, or is this somehow ok?

[–] ScoffingLizard@lemmy.dbzer0.com 2 points 1 day ago* (last edited 1 day ago) (1 children)

I'm not following. Are you saying you login with ssh keys and not the password, but leave "UsePam = no" so then if ssh fails you don't have a pam error?

[–] danielquinn@lemmy.ca 1 points 8 hours ago

It's been years since I was experimenting, trying to set things up properly, but at the time I could swear that I'd have the following set:

PubkeyAuthentication yes
PasswordAuthentication no
UsePam yes

and attempts to SSH into the system would still result in a password prompt, even though PasswordAuthentication was set to no. After some experimentation, I found that if I set UsePam to no, you wouldn't get a password prompt, so that's what I've been doing on every SSH server I've had since like, 2000.

Tinkering with it now though, I see there's also another directive, KbdInteractiveAuthentication, which when set to no, will ensure I don't see a password prompt even when UsePam is set to yes. I can only assume that 26ish years ago there was no KbdInteractiveAuthentication, or I just didn't know about / notice it!

Well no harm done in my case anyway, as I don't generally expose SSH servers to the outside world anyway. But it's good to know that I don't have to turn off PAM to disable password logins anymore.

[–] needanke@feddit.org 7 points 3 days ago

The way I read it, it is fine if you do not allow password authentication in general?

[–] GeneralDingus@lemmy.cafe 8 points 3 days ago

I use alpine with an ssh port exposed to the internet so I can connect to it. This doesn't seem to be an issue if you configured your settings to be secure.

Never use just default settings.

[–] veniasilente@lemmy.dbzer0.com 9 points 3 days ago (1 children)

If I'm running containers on Alpine, doesn't that mean that they already don't offer SSH (sshd)? The entire point of Alpine as a base is to not add stuff you don't need.

load more comments (1 replies)
[–] i_am_not_a_robot@discuss.tchncs.de 6 points 3 days ago

The container thing is extremely unlikely. However, having worked with developers before, I know there are people who are running those AWS and Azure images with internet-facing SSH password authentication. If they hadn't already been hacked, they've all been hacked now. Somebody just had to check Shodan for hosts in those IP ranges running OpenSSH and try a few usernames.

[–] tenchiken@anarchist.nexus 6 points 3 days ago

Everything behind a good firewall and proxy.

No public facing url should ever not be proxied.

Only ports you explicitly forward. Ever.

load more comments
view more: next ›