---
title: Tip: after SSHole, grep auth logs for 'Accepted password for' on accounts that should never take a password | ctxsec
url: https://ctxsec.com/items/tip-sshole-hunt-accepted-password-for-star-accounts
description: "Exploitation is confirmed. Patching is step one; proving nobody already walked in is step two. Alpine and Previdian both point at successful password accepts for * accounts as the tell."
status: "operational guidance from Alpine advisory + Previdian/SOCRadar hunting notes (Nov 5–6)"
published: 2026-11-06
---

> Exploitation is confirmed. Patching is step one; proving nobody already walked in is step two. Alpine and Previdian both point at successful password accepts for * accounts as the tell.

[← Tips & Guides](/tips) · [markdown](/items/tip-sshole-hunt-accepted-password-for-star-accounts.md)

operational guidance from Alpine advisory + Previdian/SOCRadar hunting notes (Nov 5–6)

2026-11-06

### Tip: after SSHole, grep auth logs for 'Accepted password for' on accounts that should never take a password

- Search syslog/auth for `Accepted password for` naming `alpine`, `root`, deploy users, or any account with `*` in `/etc/shadow`.
- Flag non-interactive sessions that immediately run `id`/`uname`/`hostname`, and source IPs like `89.116.89[.]18`.
- On Alpine cloud images, also review `doas` use and new `authorized_keys` — the default `alpine` user can be passwordless-doas root.
- If you cannot explain a hit, treat the host as compromised: rotate keys/secrets, rebuild from known-good images where needed.

Sources: [Alpine Linux advisory](https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/) · [Help Net Security / Previdian exploitation note (Nov 6)](https://www.helpnetsecurity.com/2026/11/06/openssh-sshole-cve-2026-123158-exploitation/)