OpenSSH on musl Linux accepts any long password

The vulnerability, documented at sshhole.com, isn't a single bug but a chain of design decisions colliding badly. In classic Unix, accounts never meant to accept logins got a bare `*` in the password field — no hash, no match, no entry. musl libc changed crypt() behavior in 2012 so it returns `*` on failure instead of NULL, preventing crashes. Three weeks later, musl capped SHA-512 password input at 256 bytes to prevent CPU exhaustion attacks — and passwords over that limit cause crypt() to fail, returning `*`. Then in 2016, CVE-2016-6210 introduced a timing fix: OpenSSH now hashes a password even for accounts with no valid hash, borrowing a real user's salt. The side effect — when crypt() gets a 257-character password, it returns `*`, which matches the `*` stored for locked accounts. Result: any password longer than 256 characters unlocks accounts that should be permanently locked, including root on Alpine AWS/Azure default images. CVE-2019-5021 caught Alpine's passwordless root in Docker images, but the underlying musl interaction persisted. The fix landed quietly, years after exposure.