*sshole · sshhole.com
sshhole.com
openssh on musl linux has been letting people into password-less accounts since 2016.
    • N.E.P.T.R@lemmy.blahaj.zoneEnglish
      31·
      27 minutes ago

      musl is far more POSIX compliant, secure, and cleaner code (no dirty hacks) than glibc. Not everything has to be a culture war. Do you use sudo (ISC-style)? Do you use curl (MIT-style, curl license)? Even OpenSSH isn’t GPL (BSD). Not everything is a plot; vulnerabilities happen regardless of what license you pick.

      • thingsiplay@lemmy.ml
        2·
        9 minutes ago

        Also in addition to that info, I like about musl to be able to compile without relying on glibc, which is a “common” (notice I set it in quotes, don’t take it literally) source of dependency problem. Often if there is a glibc dependency problem, then you can’t do much about it, because the entire system relies on the correct one. With musl your application doesn’t depend on external library.

  • everett@lemmy.ml
    4·
    2 hours ago

    openssh on musl linux (alpine, openwrt, buildroot, yocto, and a lot of the docker images you’ve pulled)

  • RedSnt ♾️🦋♂️👓🖥️🐧@feddit.dkEnglish
    2·
    1 hour ago
    I have 4 accounts on my OpenWRT router with * as their password, but I did try with a random password over 256 characters and I couldn't log into them. 
    daemon:*:1:1:daemon:/var:/bin/false
ftp:*:55:55:ftp:/home/ftp:/bin/false
network:*:101:101:network:/var:/bin/false
nobody:*:65534:65534:nobody:/var:/bin/false

    Still, this is a huge security flaw!