Alpine Linux OpenSSH password bypass (Nov 2026): are you affected? A read-only checker script

This morning (5 November 2026) Alpine Linux published an advisory: with Alpine's openssh-server package, an attacker who can reach your SSH port can log in without knowing any password, under very common settings. One connection, works every time. No CVE yet.

If you have an Alpine box reachable over SSH (a VPS, a router, a Raspberry Pi, an LXC container, a cloud VM), check it now. I wrote a read-only checker script and tested it in a throwaway Alpine 3.24 root filesystem.

The bug in plain words

Alpine's sshd is built without PAM, so it checks a password by hashing the attempt with the C library's crypt() and comparing the result with the stored field.

Two things meet:

1. Accounts without a password have * in their password field (normal for key-only users, and root ships as root:* in the base image since ~3.16).
2. musl's crypt() returns * as an error indicator when the key is longer than 256 bytes.

So the "hash" is *, the stored value is *: match, you're in. The attacker sends a 257–1024 byte password for a * account, provided the machine has at least one other account with a real $5$ or $6$ hash (sshd borrows its salt).

You are affected if all of these are true

• Alpine openssh-server (no PAM), or openssh-server-pam with UsePAM no;
• PasswordAuthentication yes (the default!);
• an account with * as password field (root, a key-only user, the alpine user of tiny-cloud images);
• at least one account with a $5$/$6$ hash.

Root is protected by the default PermitRootLogin prohibit-password, but a key-only user who can doas to root is just as bad.

Not affected: containers that don't run sshd; PasswordAuthentication no; openssh-server-pam with UsePAM yes; locked (!) accounts; cloud-init images (they write PasswordAuthentication no).

Check it

Save as alpine-sshd-check.sh and run as root: sh alpine-sshd-check.sh (messages are Hungarian + English).

#!/bin/sh
# alpine-sshd-check.sh — érintett-e ez az Alpine-gép az OpenSSH jelszavas belépés-megkerülésében (2026-11-05)?
# Is this Alpine host affected by the OpenSSH password authentication bypass (Alpine advisory, 2026-11-05)?
# Csak olvas, semmit nem módosít. Read-only. Run as root:  sh alpine-sshd-check.sh
# Forrás / source: https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/
# MIT license — AikaHub (https://aikahub.com)

red() { printf '\033[31m%s\033[0m\n' "$*"; }
grn() { printf '\033[32m%s\033[0m\n' "$*"; }
ylw() { printf '\033[33m%s\033[0m\n' "$*"; }

[ -f /etc/alpine-release ] || { echo "Ez nem Alpine Linux — a hiba csak az Alpine openssh-csomagját érinti. (Not Alpine.)"; exit 0; }
[ "$(id -u)" = 0 ] || { echo "Rootként futtasd (az /etc/shadow és az sshd -T miatt). Run as root."; exit 2; }
REL=$(cut -d. -f1,2 /etc/alpine-release)
echo "Alpine $(cat /etc/alpine-release)"

# 1) csomag és javított verzió / package and fixed version
PKG=""; for p in openssh-server openssh-server-pam; do apk info -e "$p" >/dev/null 2>&1 && PKG=$p; done
if [ -z "$PKG" ]; then grn "✔ Nincs openssh-server telepítve — nem érintett. (No openssh-server.)"; exit 0; fi
VER=$(apk info -v 2>/dev/null | grep "^$PKG-[0-9]" | head -1 | sed "s/^$PKG-//")
case "$REL" in
  3.24) FIX=10.3_p1-r2 ;; 3.23) FIX=10.2_p1-r1 ;; 3.22) FIX=10.0_p1-r11 ;; 3.21) FIX=9.9_p2-r1 ;;
  3.20) FIX=9.7_p1-r6 ;; 3.19) FIX=9.6_p1-r3 ;; 3.18) FIX=9.3_p2-r4 ;; 3.17) FIX=9.1_p1-r7 ;; 3.16) FIX=9.0_p1-r6 ;;
  *) FIX=10.6_p2-r0 ;;   # edge (és ismeretlen ág)
esac
PKG_OK=0; [ "$(apk version -t "$VER" "$FIX")" != "<" ] && PKG_OK=1
echo "Csomag / package: $PKG $VER (javított / fixed: $FIX)"

# 2) fut-e még a régi sshd a frissítés után / is the running sshd still the old binary?
OLD_RUNNING=0
for pid in $(pidof sshd 2>/dev/null); do
  case "$(readlink /proc/$pid/exe 2>/dev/null)" in *deleted*) OLD_RUNNING=1 ;; esac
done

# 3) érvényes sshd-beállítás / effective sshd config
CFG=$(sshd -T 2>/dev/null)
[ -n "$CFG" ] || { CFG=$(sshd -T -C user=root,host=localhost,addr=127.0.0.1 2>/dev/null); }
PA=$(echo "$CFG" | awk '$1=="passwordauthentication"{print $2}')
UP=$(echo "$CFG" | awk '$1=="usepam"{print $2}')
PRL=$(echo "$CFG" | awk '$1=="permitrootlogin"{print $2}')
[ -n "$PA" ] || PA="yes?"
echo "sshd: PasswordAuthentication=$PA UsePAM=${UP:-nincs/none} PermitRootLogin=${PRL:-?}"
if echo "$CFG" | grep -qi '^match'; then ylw "  Figyelem: van Match blokk — ott külön is lehet PasswordAuthentication yes. (Match block present.)"; fi
PAM_SAFE=0; [ "$PKG" = openssh-server-pam ] && [ "$UP" = yes ] && PAM_SAFE=1

# 4) fiókok / accounts
STAR=$(awk -F: '$2=="*"{print $1}' /etc/shadow | tr '\n' ' ')
HASH=$(awk -F: '$2 ~ /^\$[56]\$/{n++} END{print n+0}' /etc/shadow)
echo "Jelszó nélküli ('*') fiókok / '*' accounts: ${STAR:-nincs}"
echo "\$5\$/\$6\$ jelszavas fiókok száma / hashed accounts: $HASH"

# 5) ítélet / verdict
echo
VULN_CFG=0
[ "$PAM_SAFE" = 0 ] && [ "$PA" != no ] && [ -n "$STAR" ] && [ "$HASH" -gt 0 ] && VULN_CFG=1
if [ "$PKG_OK" = 1 ] && [ "$OLD_RUNNING" = 0 ]; then
  grn "✔ Javított csomag, és már az új sshd fut. (Fixed package, new sshd running.)"
elif [ "$PKG_OK" = 1 ]; then
  red "✘ A csomag javított, de még a RÉGI sshd fut! Indítsd újra: rc-service sshd restart"
elif [ "$VULN_CFG" = 1 ]; then
  red "✘ ÉRINTETT: régi csomag + jelszavas belépés + '*' fiók + van jelszó-hash. (AFFECTED.)"
  red "  Most: apk upgrade -U -a && rc-service sshd restart   (vagy / or: PasswordAuthentication no)"
else
  ylw "! Régi csomag, de a mostani beállítással nem kihasználható. Frissíts így is: apk upgrade -U -a && rc-service sshd restart"
fi
case " $STAR " in *" root "*) [ "$PRL" = yes ] && [ "$PKG_OK" = 0 ] && red "  root is elérhető (PermitRootLogin yes)!" ;; esac

# 6) nyomok a naplóban / traces in the log
LOG=/var/log/messages
if [ -n "$STAR" ] && [ -r "$LOG" ]; then
  HIT=""
  for u in $STAR; do
    grep -h "sshd.*Accepted password for $u " "$LOG" "$LOG".* 2>/dev/null | tail -3 | while read -r l; do echo "  $l"; done
    grep -qh "sshd.*Accepted password for $u " "$LOG" "$LOG".* 2>/dev/null && HIT="$HIT $u"
  done
  if [ -n "$HIT" ]; then red "✘ GYANÚS: jelszavas belépés jelszó nélküli fiókba:$HIT — kezeld feltörtként! (Suspicious logins.)"
  else echo "Napló: nincs 'Accepted password' jelszó nélküli fiókra. (No suspicious logins in $LOG.)"; fi
fi

What it looks at:

• which openssh package is installed and whether it's at or above the fixed version for your Alpine branch (from the advisory's table);
• whether the old sshd is still running: upgrading the package does not restart the daemon, and the replaced binary shows up as (deleted) in /proc/<pid>/exe;
• the effective sshd config (sshd -T), with a warning for Match blocks;
• * and $5$/$6$ accounts in /etc/shadow;
• suspicious Accepted password for lines for passwordless accounts in /var/log/messages.

In the throwaway Alpine 3.24.4 it answered: fresh box → "fixed package"; simulated old version with a key-only user plus one hashed account → "AFFECTED"; same with PasswordAuthentication no → "old package, not exploitable with the current config".

Fix

apk upgrade -U -a
rc-service sshd restart

The restart is not optional: the old sshd keeps running until you restart it.

Fixed versions: 3.24 → 10.3_p1-r2, 3.23 → 10.2_p1-r1, 3.22 → 10.0_p1-r11, 3.21 → 9.9_p2-r1, edge → 10.6_p2-r0. Fixed packages were also published for the unsupported 3.16–3.20.

Can't upgrade right now? Disable password logins (make sure key login works first and keep your current session open):

mkdir -p /etc/ssh/sshd_config.d
echo 'PasswordAuthentication no' > /etc/ssh/sshd_config.d/00-no-passwords.conf
sshd -t && rc-service sshd restart
sshd -T | grep -i passwordauthentication   # passwordauthentication no

Alpine before 3.19 doesn't read sshd_config.d; edit /etc/ssh/sshd_config directly there.

If you find a suspicious line

Accepted password for root (or alpine, or any key-only user) in /var/log/messages means someone logged in with a password to an account that has none. Treat the machine as compromised: review doas use, new users, authorized_keys, and reinstall if you can't rule it out.

Sources: Alpine advisory, OpenSSH 10.6p2 release notes.

Originally written in Hungarian on AikaHub, a Hungarian community about running your own AI and homelab at home. — Aika 🦊