[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fICoDeHw0z5Vv9a8rVd27O6TjmOpJC6tcNEfmxy9Wt9Y":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"3c5d899b-1c94-40c8-9d22-fedfddcd4268","openssh-sshole-flaw-enables-login-to-password-disabled-linux-accounts","bfca9591-485c-4957-a574-2d1e5623966b","OpenSSH '*sshole' Flaw Enables Login to Password-Disabled Linux Accounts","A vulnerability in OpenSSH, present since 2016, allowed attackers to bypass password-disabled account restrictions on musl-based Linux systems (such as Alpine Linux) by sending an oversized password string when PAM is disabled. This meant accounts explicitly configured to reject password authentication — including default 'alpine' root accounts — could be silently compromised, potentially granting full root access. The flaw highlights how dangerous default credentials and misconfigured authentication stacks can be when combined with an unpatched vulnerability. It matters because Alpine Linux is widely used in containerized and cloud-native environments, dramatically broadening the attack surface. The fix has been available since OpenSSH 10.6p2, making timely patching the most direct mitigation.","**Immediate actions:**\n- Upgrade all affected systems to OpenSSH 10.6p2 or later without delay, prioritizing internet-facing and container-based deployments.\n- Audit all Linux systems for default or well-known accounts (e.g., 'alpine') and disable or rename them immediately.\n- Enable PAM on all musl-based systems where OpenSSH is in use, as this configuration combination was the root prerequisite for exploitation.\n\n**Long-term improvements:**\n- Establish a formal patch management policy with defined SLAs (e.g., critical CVEs patched within 72 hours) and enforce it across container base images.\n- Maintain a continuously updated inventory of all operating system types, SSH configurations, and authentication stack settings across the environment.\n- Enforce a secure-by-default configuration baseline for all Linux deployments, prohibiting password-based SSH authentication in favor of key-based or certificate-based authentication.\n\n**Detection measures:**\n- Deploy SSH log monitoring and alerting to detect anomalous login attempts, especially successful logins to accounts that should have authentication disabled.\n- Integrate container image scanning into CI\u002FCD pipelines to flag outdated or vulnerable OpenSSH versions before images reach production.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 17: Incident Response Management","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"NIST SP 800-53 SI-2: Flaw Remediation":21,"CIS Control 17: Incident Response Management":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires entities to implement measures covering incident handling and vulnerability management; the prolonged existence of this flaw without detection or remediation would represent a gap in the technical security measures required under this article.","SI-2 requires organizations to identify, report, and correct information system flaws; applying this control would have mandated timely installation of OpenSSH 10.6p2 once the vulnerability was disclosed.","Given this flaw may have been silently exploited since 2016, a mature incident response capability — including retrospective log analysis — is essential to determine whether unauthorized logins occurred before the patch was applied.","Running an OpenSSH version carrying a known authentication bypass vulnerability is a direct instance of using an outdated component; OWASP A06 guidance calls for inventorying and updating such components continuously.","The OpenSSH flaw existed since 2016 and a patch is now available; a continuous vulnerability scanning and patching program would have identified the outdated OpenSSH version and enforced remediation before attackers could exploit it.","This control requires timely identification and remediation of technical vulnerabilities in deployed software; following it would have flagged the OpenSSH flaw and driven patching across Alpine Linux-based systems.","The vulnerability undermined authentication controls on accounts explicitly configured to deny password logins; PR.AA calls for ensuring authentication mechanisms function as intended and are resilient to bypass.","published","2026-11-05T18:20:27.412587+00:00","2026-11-05T18:20:27.385+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fopenssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts\u002F","openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts-0104ff","OpenSSH flaw lets attackers log into password-disabled Linux accounts",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":42,"name":43,"slug":44,"description":45,"color":46},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[49,53,56],{"slug":50,"name":51,"problem":52},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":44,"name":54,"problem":55},"Automated patch management","Known holes get closed in days, not months.",{"slug":57,"name":58,"problem":59},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date."]