News for hackers. Stuff that matters.
Re:Sshole by hypfer on Thursday November 05, 2026 @07:41AM (#50378417)
What is out there that uses musl without PAM and hosts an SSHd with PasswordAuthentication?

As in: "Actually out there"

The hypothetical Alpine exists, yes, but what runs that like that?

Re:Sshole by jbyers on Thursday November 05, 2026 @07:45AM (#50378440)
A large number of Docker containers?
Re:Sshole by ekidd on Thursday November 05, 2026 @07:48AM (#50378469)
Many, many Docker containers rely on "docker exec" or the kubectl equivalent to gain CLI access when needed. To have sshd in an Alpine Docker container, you're generally need to be running init and a bunch of demons, not just a single standalone service.

I'm guessing in practice relatively few people are actually exposed. But if they are, it's catastrophic.

Re:Sshole by hypfer on Thursday November 05, 2026 @07:46AM (#50378452)
Docker containers that run sshds?
Re:Sshole by stingraycharles on Thursday November 05, 2026 @07:50AM (#50378495)
Docker containers run sshd?
Re:Sshole by hypfer on Thursday November 05, 2026 @09:56AM (#50379863)
> Edit 2: You really don't need to look very hard to find public container examples at million-download scale.

It would be super helpful if you would answer a "what, specifically" question with a "this, specifically" itemized list or not answer at all.

This is not helpful.

Re:Sshole by Bender on Thursday November 05, 2026 @07:51AM (#50378503)
Possibly public SFTP servers. I've allowed null passwords in the past for anonymous public SFTP and I run Alpine Linux exclusively for my servers both VM's and physical. The shadow package (PAM) did not get installed by default. I installed it but I had to specify it in the installation.
Re:Sshole by Bender on Friday November 06, 2026 @09:09AM (#50392468)
[delayed]
Re:Sshole by figassis on Thursday November 05, 2026 @08:07AM (#50378640)
Agent sandboxes today probably