# sshole

- HackerByte page: <https://hackerbyte.net/en/stories/a-command-line-tool-for-ssh-connections-50378228>
- Original source: <https://sshhole.com/>
- Hacker News discussion: <https://news.ycombinator.com/item?id=50378228>
- Submitted to Hacker News: 2026-11-05T12:19:02.000Z

A command\-line tool for SSH connections.

## AI-generated summary

A long\-standing vulnerability in OpenSSH on musl Linux systems allows accounts with a '\*' in their shadow file to accept any password longer than 256 characters. This issue, stemming from historical \`crypt\(\)\` function behavior and exacerbated by musl's SHA512 crypt implementation, has gone unnoticed for years. The vulnerability affects systems not using PAM and with password authentication enabled, potentially leading to unauthorized access.

## Key points

- Accounts with '\*' as their password hash in /etc/shadow on musl Linux can accept any password between 257 and 1024 characters.
- This issue originates from \`crypt\(\)\` returning NULL on failure and musl's subsequent change to return '\*' for failed SHA512 crypt operations.
- OpenSSH's fix for timing attacks \(CVE\-2016\-6210\) inadvertently masked this vulnerability for accounts with '\*'.
- The vulnerability affects systems not using PAM and where password authentication is enabled, particularly default Alpine Linux images.
- OpenSSH 10.6p2 addresses the vulnerability; disabling password authentication is a temporary workaround.