this post was submitted on 05 Nov 2026
254 points (96.7% liked)

Selfhosted

63779 readers
354 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
254
Check if you need to update all your stuff - again. (sshhole.com)
submitted 1 week ago* (last edited 1 week ago) by smiletolerantly@awful.systems to c/selfhosted@lemmy.world
83 comments fedilink hide all child comments
 

are you affected?

  • is your sshd running on musl? (alpine, openwrt, buildroot, yocto)
  • is it not using pam? alpine's openssh-server doesn't by default, or maybe you set UsePAM no
  • are password logins still on? they are by default
  • is there an account with just * as its password? key-only users, ldap users, root on alpine
  • and some other account with a real password?
  • then that * account takes any password between 257 and 1024 characters

on alpine's official aws and azure images that's the default alpine user, and it has passwordless doas. so it's root

on debian, ubuntu, fedora or anything else with glibc? going through pam? dropbear? openbsd? you're fine

top 50 comments
sorted by: hot top controversial new old
[–] panda_abyss@lemmy.ca 66 points 1 week ago* (last edited 1 week ago) (2 children)

Jesus Christ. Why?! How?

Edit: I can't figure out how to upload gifs to Lemmy... please imagine castle-nathan.gif

[–] NoLemurs@lemmy.world 25 points 1 week ago (3 children)

castle-nathan.gif

I don't know why, but I always assumed that image was from Firefly. It's the same color shirt and everything!

[–] lka1988@lemmy.dbzer0.com 8 points 1 week ago

There are a lot of references to Firefly in Castle. It's quite entertaining.

[–] bjoern_tantau@swg-empire.de 8 points 1 week ago (1 children)

Didn't he dress up as a "space cowboy" in one episode?

load more comments (1 replies)
[–] Vittelius@feddit.org 7 points 1 week ago

I can't figure out how to upload gifs to Lemmy...

![alt text - optional, you can keep this empty, but you need the brackets](https://website.tld/castle-nathan.gif)

[–] tal@lemmy.today 40 points 1 week ago

did you get hacked? check.

$ grep "Accepted password" /var/log/messages

That's a really bad check unless you have an external box receiving logs and you're looking there, because the first thing that a sophisticated attacker is going to do if they get in as root is remove the signs of their presence.

[–] possiblylinux127@lemmy.zip 32 points 1 week ago

This isn't nearly as bad as I thought it was. Also the author is very reliant on AI to the point where they didn't think about what if someone wipes the logs.

Any effected devices should be wiped and redeployed

[–] tofu@lemmy.nocturnal.garden 32 points 1 week ago (3 children)

I mean, not that it's not severe, but which container images have ssh baked in? If you're using good stripped down images, you're fine here.

Not sure where the overlap is between"ssh is enabled" and "one of those OSes". LXCs maybe?

[–] ikidd@lemmy.dbzer0.com 23 points 1 week ago* (last edited 1 week ago) (1 children)

SSH enabled and the SSH port of the container accessible and it's set for password auth.

load more comments (1 replies)
[–] HelloRoot@lemy.lol 7 points 1 week ago (6 children)

Maybe something like git forges and gist alternatives?

[–] possiblylinux127@lemmy.zip 5 points 1 week ago

They use key based authentication

load more comments (5 replies)
load more comments (1 replies)
[–] HCSOThrowaway@lemmy.world 31 points 1 week ago* (last edited 1 week ago) (4 children)

I'm no cybersecurity expert, but from what I've heard from those who are, this is the new normal as anyone who formerly had no chance due to being a "script kiddie" can now just prompt an AI* to eventually find a vulnerability.

* oversimplification redacted

[–] colourlesspony@pawb.social 16 points 1 week ago (1 children)

Yep, those new fangled slop-kitties. The worst part is that there brute force hacking is being subsidized by people 401ks.

[–] HCSOThrowaway@lemmy.world 6 points 1 week ago* (last edited 1 week ago)

The irony - of course - is that their 401k money goes right into hacking those same people's 401ks.

... but at least we can brainrot an entire generation with glass fruit slices and put artists out of work?

Now if you'll excuse me, I have to go convince someone that the TikTok deepfakes they're watching aren't real and that cops don't really employ nanny-boo-boos to unsettle criminals during interrogations. No, I'm not joking.

[–] lemmyvore@feddit.nl 9 points 1 week ago (1 children)

It's not quite as simple as that. The author in this case followed a pretty specific trail to find the bug.

Where AI helped was as the last step. They already knew what the bug would do and where to look, but actually looking through the source code for all the possible musl implementations out there would have taken a lot of time.

So they brute-forced it instead and asked AI to spin up actual running instances of all those implementations and simply tried the bug against each of them, rather than looking at all the code.

[–] HCSOThrowaway@lemmy.world 5 points 1 week ago* (last edited 1 week ago) (1 children)

Fair enough, but the overall idea stands:

The bar has been significantly lowered for what it takes to hack.

[–] lemmyvore@feddit.nl 8 points 1 week ago* (last edited 1 week ago) (6 children)

That's because it turns out there are tons of vulnerabilities out there introduced by very lazy and/or dumb code.

It isn't that AI has lowered the bar for hacking, it's that it's showing us just how much bad code is out there. The bar was already on the ground, we just didn't know it.

After all is said and done AI will actually end up raising the bar for security everywhere.

Unfortunately we have a lot of legacy crap to clean first.

load more comments (6 replies)
[–] hirihit640@sh.itjust.works 6 points 1 week ago* (last edited 1 week ago)

You'd think that but so far I haven't seen an actual PoC exploit for the PHP vulnerability that doesn't require misconfiguring the server. And this is over a week after the patches were released.

load more comments (1 replies)
[–] rtxn@lemmy.world 20 points 1 week ago* (last edited 1 week ago) (2 children)

That website is atrocious. It's the web design equivalent of shoving five kilograms of sugar and whipped cream in a cup of coffee.

[–] tal@lemmy.today 18 points 1 week ago (2 children)

Now, now. Starbucks is a very successful business.

[–] rtxn@lemmy.world 5 points 1 week ago* (last edited 1 week ago)

Yes, it was a stroke of genius to label their mediocre confectionery as "coffee", although it can lead to near fatalities when someone who's only ever had Starbucks encounters real coffee for the first time.

Still, my point stands. That website is like 20% useful content, 40% flair, and 40% wasted space.

[–] Onomatopoeia@lemmy.cafe 4 points 1 week ago

Oh, daaamn. Haha

[–] lagoon8622@sh.itjust.works 5 points 1 week ago

"Cyber" ppl love to do this. This is basically their resume I guess? They have to sensationalize absolutely everything they can (not that this isn't an important bug, but this could have been a 1-2 page white paper imo (like many of them))

[–] tapdattl@lemmy.world 18 points 1 week ago (8 children)

I'm assuming this is only if you allow password authentication? If you're only allowing certificate based auth you should be safe, right?

[–] chameleon@fedia.io 23 points 1 week ago

Correct, password authentication must be enabled on the SSH daemon side of things to be vulnerable. The user account being logged into, on the other hand, can't have a password set. But overall, PW auth must be on. The website OP linked is exceedingly bad at explaining the actual problem, see Alpine's announcement for better info.

https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/

load more comments (6 replies)
[–] qaz@lemmy.world 11 points 1 week ago (1 children)

Most containers don't run ssh right?

[–] lemmyvore@feddit.nl 5 points 1 week ago

Unless it's explicitly installed no. The default Alpine image doesn't come with OpenSSH.

[–] Orygin@sh.itjust.works 11 points 1 week ago (1 children)

OP I know you're trying to do good, but please try to understand the vulnerability before spreading FUD

load more comments (1 replies)
[–] veniasilente@lemmy.dbzer0.com 9 points 1 week ago (1 children)

If I'm running containers on Alpine, doesn't that mean that they already don't offer SSH (sshd)? The entire point of Alpine as a base is to not add stuff you don't need.

load more comments (1 replies)
[–] danielquinn@lemmy.ca 7 points 1 week ago (2 children)

I've been setting UsePam = no for decades because leaving it on meant that it'd still present a password login of keys failed. Is this still the case, was I wrong from the beginning, or is this somehow ok?

[–] ScoffingLizard@lemmy.dbzer0.com 2 points 6 days ago* (last edited 6 days ago) (1 children)

I'm not following. Are you saying you login with ssh keys and not the password, but leave "UsePam = no" so then if ssh fails you don't have a pam error?

[–] danielquinn@lemmy.ca 1 points 5 days ago

It's been years since I was experimenting, trying to set things up properly, but at the time I could swear that I'd have the following set:

PubkeyAuthentication yes
PasswordAuthentication no
UsePam yes

and attempts to SSH into the system would still result in a password prompt, even though PasswordAuthentication was set to no. After some experimentation, I found that if I set UsePam to no, you wouldn't get a password prompt, so that's what I've been doing on every SSH server I've had since like, 2000.

Tinkering with it now though, I see there's also another directive, KbdInteractiveAuthentication, which when set to no, will ensure I don't see a password prompt even when UsePam is set to yes. I can only assume that 26ish years ago there was no KbdInteractiveAuthentication, or I just didn't know about / notice it!

Well no harm done in my case anyway, as I don't generally expose SSH servers to the outside world anyway. But it's good to know that I don't have to turn off PAM to disable password logins anymore.

[–] needanke@feddit.org 7 points 1 week ago

The way I read it, it is fine if you do not allow password authentication in general?

[–] GeneralDingus@lemmy.cafe 7 points 1 week ago

I use alpine with an ssh port exposed to the internet so I can connect to it. This doesn't seem to be an issue if you configured your settings to be secure.

Never use just default settings.

[–] i_am_not_a_robot@discuss.tchncs.de 6 points 1 week ago

The container thing is extremely unlikely. However, having worked with developers before, I know there are people who are running those AWS and Azure images with internet-facing SSH password authentication. If they hadn't already been hacked, they've all been hacked now. Somebody just had to check Shodan for hosts in those IP ranges running OpenSSH and try a few usernames.

[–] tenchiken@anarchist.nexus 5 points 1 week ago

Everything behind a good firewall and proxy.

No public facing url should ever not be proxied.

Only ports you explicitly forward. Ever.

[–] patruelis@lemmy.world 4 points 1 week ago (4 children)

Why

load more comments (4 replies)
[–] one_old_coder@piefed.social 4 points 1 week ago (1 children)

Are your containers running Alpine?

Most containers (99%) I have ever used were using Alpine because it's small and fun. lol.

[–] Orygin@sh.itjust.works 6 points 1 week ago

And 99.9% won't have either ssh at all, or the port open, or password auth enabled.

This is a nothing burger

load more comments
view more: next ›