[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

official (Alpine Linux security advisory, Nov 5)

Tip: check every Alpine box running sshd in two minutes: password auth on, accounts with '*', and whether sshd was restarted after the update

  • Effective config: sshd -T | grep -Ei 'passwordauthentication|usepam|permitrootlogin'. If passwordauthentication yes and usepam no (or the non-PAM package), you're in scope.
  • Accounts at risk: awk -F: '$2=="*"{print $1}' /etc/shadow. Accounts that make it exploitable: awk -F: '$2 ~ /^\$[56]\$/{print $1}' /etc/shadow.
  • Patched package: apk info -v openssh-server against Alpine's fixed list, then confirm the running daemon is new: rc-service sshd restart.
  • Quickest mitigation: PasswordAuthentication no (test key login in a second session first). Locking key-only accounts with ! instead of * also blocks password logins for them.

Sources: Alpine Linux: Security advisory: openssh-server password authentication bypass (Nov 5)