---
title: Tip: check every Alpine box running sshd in two minutes: password auth on, accounts with '*', and whether sshd was restarted after the update | ctxsec
url: https://ctxsec.com/items/tip-check-alpine-sshd-exposed-to-long-password-bypass
description: "Alpine's OpenSSH bypass only works when several conditions line up, so you can check quickly and fix with one setting even before patching."
status: "official (Alpine Linux security advisory, Nov 5)"
published: 2026-11-05
---

> Alpine's OpenSSH bypass only works when several conditions line up, so you can check quickly and fix with one setting even before patching.

[← Tips & Guides](/tips) · [markdown](/items/tip-check-alpine-sshd-exposed-to-long-password-bypass.md)

official (Alpine Linux security advisory, Nov 5)

2026-11-05

### Tip: check every Alpine box running sshd in two minutes: password auth on, accounts with '*', and whether sshd was restarted after the update

- Effective config: `sshd -T | grep -Ei 'passwordauthentication|usepam|permitrootlogin'`. If `passwordauthentication yes` and `usepam no` (or the non-PAM package), you're in scope.
- Accounts at risk: `awk -F: '$2=="*"{print $1}' /etc/shadow`. Accounts that make it exploitable: `awk -F: '$2 ~ /^\$[56]\$/{print $1}' /etc/shadow`.
- Patched package: `apk info -v openssh-server` against Alpine's fixed list, then confirm the running daemon is new: `rc-service sshd restart`.
- Quickest mitigation: `PasswordAuthentication no` (test key login in a second session first). Locking key-only accounts with `!` instead of `*` also blocks password logins for them.

Sources: [Alpine Linux: Security advisory: openssh-server password authentication bypass (Nov 5)](https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/)