Sshole

Automated excerpt

so openssh on musl linux (alpine, openwrt, buildroot, yocto, and a lot of the docker images you've pulled) has had a little problem since 2016. accounts that should never take a password at all (root, your key-only deploy user, ldap users, the default user on alpine's aws and azure images) take any password longer than 256 characters. yes, any password. yes. i know. yes. back in old unix your password hash just sat in /etc/passwd, right next to your username. in a file everyone could read. in 1980 bill joy put a * there for an account called daemon.

Selected automatically from source text; not independently written or fact-checked. Read the original for full context.