Meet *sshole, the vulnerability that lets hackers SSH into Linux devices

Linux servers that run a specific OpenSSH configuration on Alpine Linux can be accessed without any password, thanks to a flaw that has lingered for over ten years. The vulnerability exploits the way OpenSSH talks to musl, Alpine’s lightweight C library, and it works every time when the right conditions line up. If you manage or rely on such devices, the risk is not theoretical—it is an immediate, exploitable backdoor.

The OpenSSH‑musl Interaction That Triggers the Flaw

OpenSSH expects to delegate authentication checks to the system’s standard libraries, but when compiled against musl, the code path diverges from the typical glibc route. Musl lacks full support for PAM (Pluggable Authentication Modules), so OpenSSH on Alpine cannot fall back to the usual authentication framework. This mismatch leaves a gap where password verification can be bypassed entirely.

The bypass occurs because OpenSSH, when built without PAM, relies on direct calls to the password‑hashing functions in musl. Those calls do not enforce the same checks that PAM would, allowing a crafted SSH session to succeed without presenting a valid credential. The exploit is deterministic: a single connection attempt is enough, with no need for retries or timing tricks.

Why Passwordless Accounts Turn the Vulnerability Into a Remote Backdoor

Two preconditions convert the library flaw into a full‑scale login vector. First, the target system must have at least one user whose password hash is stored using SHA256 or SHA512 in /etc/shadow. Second, the account the attacker wishes to assume must be marked as passwordless by placing an asterisk (*) in the password field of that same file.

Passwordless entries are common for service accounts that rely on certificate‑based SSH keys rather than passwords. Because the asterisk tells the authentication subsystem to skip password verification, the OpenSSH‑musl bug can step in and grant access without prompting for a key or a password. The result is a silent, automatic login that bypasses all conventional hardening measures.

Scope and Legacy: Alpine Linux and Potential Spillover

Alpine Linux is prized for its minimal footprint and is widely used in containers, IoT gateways, and embedded appliances. The article notes that “devices running some configurations of Alpine Linux, and possibly other distributions, are affected,” indicating that any system that mirrors the same OpenSSH‑musl build flags is at risk. This is a decade‑old vulnerability, meaning it has persisted through multiple release cycles without detection.

Because the flaw hinges on library interaction rather than a specific kernel version, any Linux distribution that adopts musl and disables PAM could inherit the same exposure. The practical upshot is that the attack surface extends beyond Alpine’s official packages to any custom images that copy its build configuration.

What This Actually Means For You

1. Passwordless accounts are a liability: Any user entry with “*” in /etc/shadow can be hijacked if the system also stores SHA‑based password hashes.
2. Systems built without PAM lack a critical safety net; the OpenSSH‑musl mismatch removes a layer of verification that most admins assume is present.
3. Because the exploit works on the first attempt, traditional intrusion‑detection signatures that look for repeated failures will not catch it.
4. Containers and embedded devices that inherit Alpine’s default OpenSSH build are likely vulnerable without additional hardening.
5. Legacy deployments that have not been audited in years may be silently exposing privileged access to attackers.

Immediate Action Steps

Audit every Alpine‑based host for the presence of an asterisk in the password field of /etc/shadow and replace passwordless entries with either disabled accounts or accounts that enforce key‑based authentication. If a passwordless account is required, ensure it is not paired with a SHA256/SHA512 hash elsewhere on the system.

Recompile or replace OpenSSH with a version that links against glibc or, at minimum, enables PAM support on musl systems. Updating to the latest OpenSSH package from the distribution’s security repository can also mitigate the issue if the vendor has back‑ported a fix.

Frequently Asked Questions

How does the OpenSSH‑musl bug allow login without a password?

The bug bypasses the normal password check because OpenSSH built with musl cannot invoke PAM; it directly validates credentials against the hash file, and when the password field is “*”, the check is skipped entirely.

Are non‑Alpine Linux distributions vulnerable to the same exploit?

Any distribution that uses musl as its C library and disables PAM for OpenSSH can be affected, though the article cites Alpine as the primary example.

What is the role of SHA256/SHA512 hashes in the exploit?

The attacker needs at least one user whose password is stored with a SHA256 or SHA512 hash; this satisfies the condition that the system has a modern hash algorithm present, which the exploit leverages to complete the login.

What Do You Think?

Given that a single misconfiguration can hand over root‑level access, should organizations continue to rely on passwordless service accounts without a comprehensive audit of their SSH build environment?