SSHole: passwordless login bug hits Alpine Linux
Original: Meet *sshole, the vulnerability that lets hackers SSH into Linux devices
Why This Matters
Alpine's billion-plus Docker pulls mean vulnerable configs are widely distributed across infrastructure.
A decade-old flaw dubbed *sshole lets attackers SSH into Alpine Linux devices with any 256+ character string as password, requiring no retries. Checkpoint confirmed the bug; ~22M SSH-exposed systems exist on Shodan.
Devices running certain Alpine Linux configurations are exposed to a critical authentication bypass that requires zero password knowledge. The vulnerability ties together three components: OpenSSH, the musl libc alternative used by Alpine, and the absence of PAM (pluggable authentication modules). When those three align, an attacker can type any string longer than 256 characters into a password prompt and gain access to a passwordless account — accounts configured with a "*" in /etc/shadow, commonly used for certificate-based auth.
Two more conditions apply: at least one other account on the system must have a password hashed with SHA256 or SHA512, and the target account must be active. Checkpoint researchers explain that sshd borrows the salt from that hashed account — without it, the attack fails. Root accounts are protected under Alpine's default PermitRootLogin setting, but accounts with sudo or doas rights can still escalate.
Alpine maintainers put it bluntly: "It takes one connection, works every time, and needs no retries." The Docker Hub Alpine base image has over 1 billion downloads. Alpine is embedded in routers, smart TVs, and industrial controllers — many of which cannot be patched easily. Shodan shows roughly 22 million systems with port 22 open. The share meeting all exploit conditions is small, but automated scanning makes identifying them trivial.