Security site flags OpenSSH-on-musl flaw letting 256+ character passwords log in
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
A security site says OpenSSH on musl Linux accepts any password over 256 characters for accounts meant to be locked.
The affected setups include Alpine, OpenWrt and many Docker images, so key-only and root accounts may be reachable.
Background
musl is the C library underneath Alpine Linux and several other minimal Linux systems; its crypt() function returns a single `*` character when hashing fails, and since 2012 it has capped sha512crypt keys at 256 bytes (KEY_MAX 256) as DoS protection. A security site (sshhole.com) states that OpenSSH's sshd on musl-based systems has had a problem since 2016: accounts that should never accept a password — root, key-only deploy users, ldap users, and the default user on Alpine's AWS and Azure images — accept any password longer than 256 characters. The site traces the root cause to the interaction between musl's `*`-on-failure behavior and OpenSSH's password check.
How it unfolded
- 1980Bill Joy put a `*` in the password field for an account called `daemon` in /etc/passwd; since `*` is not a hash, no password can match it.
- Aug 2012musl commit b3c4cc12 makes crypt() return an unmatchable single character, `*`, instead of NULL on failure.
- Aug 29, 2012musl commit 88bf5a8a adds sha256/sha512 crypt and caps the key at 256 bytes (KEY_MAX 256) for DoS protection; past 256 bytes crypt fails and returns `*`.
- Jul 2016OpenSSH fixes CVE-2016-6210, a timing leak: for invalid users sshd now determines an appropriate salt and hashes the password anyway to equalize timing.
- 2019Alpine Docker images are found to have no root password (CVE-2019-5021); Alpine fixes it by locking root with `!`.
- 2022Alpine 3.16 switches root to `*` (aports commit fbe926af), which the commit says still forbids password login but allows ssh key logins with pam disabled.
Key terms
- OpenSSH
- A suite of secure networking utilities based on the SSH protocol that provides encrypted communication over insecure networks.
- musl
- A lightweight C standard library for Linux-based systems, released under the MIT license and aimed at embedded and mobile devices.
- crypt()
- A POSIX C library function that computes password hashes and outputs a string encoding the salt and hash algorithm.
Source: Wikipedia
Who’s saying what
- Caution
- The security site states that OpenSSH on musl Linux has had this problem since 2016 and that locked accounts accept any password longer than 256 characters.
- Official
- musl's commit message says crypt returns an unmatchable hash rather than NULL on failure, and that the 256-byte key limit was added for DoS protection rather than being part of the original design.
- Official
- Alpine's aports commit fbe926af says locking root with `*` still forbids password login but allows logins via ssh keys with pam disabled.
Still unverified
The musl commit message says the NULL-return change was "reportedly" needed, without stating who reported it.