SSH password authentication security debate
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
OpenSSH released version 10.6p2 on Nov 5, 2026, fixing a password-login bypass on musl Linux without PAM.
Affected admins are told to turn off password login now; keys can't be guessed.
Background
OpenSSH is the widely used software behind SSH, the protocol admins use to log into remote servers. The bug affects Linux systems built on the musl C standard library (a lightweight alternative to the more common glibc) — including Alpine, OpenWrt, Buildroot, Yocto and many Docker images — when they don't use PAM (Pluggable Authentication Modules, the usual plug-in system for checking passwords). The OpenSSH and Alpine Linux developers moved quickly because they fear attackers could also find the bug soon with AI assistance.
How it unfolded
- 2012musl changes crypt() so it no longer returns NULL on failure, returning a single character that can never match a real password.
- 2016CVE-2016-6210, an sshd timing flaw that let attackers learn which users exist, is fixed by hashing passwords against another account's salt for invalid users.
- 2022Alpine 3.16 switches root's locked password marker from `!` to `*`, so SSH keys work again while root stays locked.
- Oct 30, 2026A Cloud Explainers lab video shows a bot logging into a forgotten test account on its fifth guess with password login on; after setting PasswordAuthentication no, all guesses are denied.
- Oct 31, 2026A report says 333 Tor exit nodes were hijacked, redirecting SSH connections to 12 servers to steal passwords and install Ebury malware.
- Nov 5, 2026OpenSSH warns of a serious bug on musl-based Linux without PAM where password authentication can apparently be bypassed; version 10.6p2 fixes it, already available for Alpine, while other distributions and many download servers still offer 10.6p1.
Key terms
- OpenSSH
- A suite of secure networking utilities based on the SSH protocol that provides encrypted communication over insecure networks.
- musl
- A lightweight C standard library for Linux-based systems, released under the MIT license and aimed at embedded and mobile devices.
- PAM
- A mechanism that integrates multiple low-level authentication schemes into a high-level API, letting programs authenticate independently of the underlying scheme.
Source: Wikipedia
Who’s saying what
- Official
- OpenSSH developers believe the problem does not originate in OpenSSH itself, but released a new version quickly to mitigate it.
- Analysts
- heise online says SSH key authentication is generally preferable and affected users should update as soon as possible and disable password-based SSH access until then.
- Caution
- Pasqualepillitteri.it argues the defense that holds up over time is having no SSH passwords to steal, recommending PasswordAuthentication no and keys only on exposed servers and jump hosts.
Still unverified
On affected systems, password authentication "can apparently be bypassed," allowing access without knowing the password, per the OpenSSH and Alpine warnings. The OpenSSH developers believe the problem does not originate in OpenSSH itself. On the hijacked Tor nodes, IMAPS and POP3S were reportedly also closed and plaintext IMAP and POP3 reopened, "according to reports."