Isn't it the opposite, accounts which have no password and hence had * instead of a hash? I.e. the bug is:
> accounts that should never take a password at all (root, your key-only deploy user, ldap users, the default user on alpine's aws and azure images) take any password longer than 256 characters.
But the correct behavior was supposed to be:
> a * isn't a hash, so no password can match it. unix still does this today'
> and if the field is just *? there's nothing to match. type whatever you want, it's never getting you in
I only ever see Alpine Linux used for containers which don't need accounts with interactive user logins, which is not to say it doesn't exist, just that it doesn't seem like Alpine comes with all preconditions met out of the box