Hacker News Reader

Comment by dpoloncsak | Hacker News Reader

Maybe I'm misunderstanding, but u/tonnydourado pointed out on another thread https://news.ycombinator.com/item?id=50378228#50380029

"It starts with a bold claim: "ssh accounts that should not accept a password will accept any password between 256 and 1024 characters". But then it keeps adding qualifiers:

- sshd compiled with musl

- not using PAM

- password logins enabled

- at least one account with '*' as the password "hash"

- at least one OTHER account with a valid password

The conditions are all ANDed, miss a single one and you're fine."

This doesn't seem to be nearly as big as an issue as they're making it out to be

View on HN

Alpine matches the first.

Disabling PAM has been "generally good security advice" for decades; I remember suggestions to not use it in the 2000s.

Password logins are often enabled, especially on multi-user and default setups.

If alpine uses the * feature, it's going to be pretty common. Gentoo has it, as does Ubuntu.

If password logins are enabled, you're almost guaranteed to have at least one user with a password (root on all my boxes has one, even if I never use it and it's random garbage).

So the cheese lines up pretty well, this affects quite a bit.

If password logins are enabled, someone almost certainly has a password.

So it's essentially one of the 'recommended configurations'?

I'm seeing people I generally trust in the scene memeing on twitter, while others are freaking out. Its hard for me to tell how fucked we are, I guess

It's always 50/50, you're either fucked or you ain't.

I think this time around it's mainly Alpine Linux and a few custom-rollers (Gentoo with musl could easily get to this place).

Yeah, as the dust starts to settle a bit it seems this is the largest case. Many 'stock' Alpine images, Docker images built on those, and embedded systems seem to be the main candidates.

Which distro has password authentication enabled by default? I haven’t seen that in years.

No, no don't let all of that distract you. We gotta hype this. This is the new SSH2SHELL dude. Have we registered the domain yet? I'm scheduled on Fox News tomorrow.

They are going to be disappointed with SSH2SHELL it definitely isn't worth the hype. Using argument injection vulnerability created by a recent pull request that has been patched isn't exciting enough for a web site.

Reply on news.ycombinator.com