Re:Sshole
by zamadatix on Thursday November 05, 2026 @10:20AM
(#50380214)
Isn't it the opposite, accounts which have no password and hence had * instead of a hash? I.e. the bug is:
> accounts that should never take a password at all (root, your key-only deploy user, ldap users, the default user on alpine's aws and azure images) take any password longer than 256 characters.
But the correct behavior was supposed to be:
> a * isn't a hash, so no password can match it. unix still does this today'
> and if the field is just *? there's nothing to match. type whatever you want, it's never getting you in
> accounts that should never take a password at all (root, your key-only deploy user, ldap users, the default user on alpine's aws and azure images) take any password longer than 256 characters.
But the correct behavior was supposed to be:
> a * isn't a hash, so no password can match it. unix still does this today'
> and if the field is just *? there's nothing to match. type whatever you want, it's never getting you in