Musl's OpenSSH Bug Lets Anyone Log In as Root With a 257-Character Password

Sshole

Since 2016, OpenSSH on musl-based systems like Alpine, OpenWrt, and many Docker images has accepted any password longer than 256 characters for accounts locked with a `*` in /etc/shadow — including root and key-only users. The cause is a chain of well-meaning fixes: musl's crypt() returns `*` on failure, and sshd's timing-attack fix hashes long passwords against a borrowed salt, producing a match. OpenSSH 10.6p2 patches it; disabling password authentication is the workaround.