← Back to context

Comment by hypfer

2 days ago

What is out there that uses musl without PAM and hosts an OpenSSH SSHd with PasswordAuthentication?

As in: "Actually out there"

The hypothetical Alpine exists, yes, but what runs that like that?

8 comments

hypfer

Reply
Bender  2 days ago

What is out there that uses musl without PAM and hosts an OpenSSH SSHd with PasswordAuthentication?

Possibly public SFTP servers. I have allowed null passwords in the past for anonymous public SFTP and I run Alpine Linux exclusively for my servers both VM's and physical. The shadow package (PAM) did not get installed by default. I installed it but I had to specify it in the installation so there are likely people without it. There is probably a way to find them on shodan.io.

I will activate one for people to play around with for today:

    sftp hn@ping.ohftp.org

There's no firewall and no password. Hack away HN.

    PasswordAuthentication yes
    PermitEmptyPasswords yes

cd /pub

get so*

  • Bender  1 day ago

    Hopefully some had a chance to have some fun. I moved sshd back behind haproxy. There's still no firewall but ssh should be invisible now.

jbyers  2 days ago

A large number of Docker containers?

Edit: Sure, a small minority presumably run sshd under these conditions. But a small minority times the number of Alpine containers running in the world gets to a large absolute number.

Edit 2: You really don't need to look very hard to find public container examples at million-download scale.

  • ekidd  2 days ago

    Many, many Docker containers rely on "docker exec" or the kubectl equivalent to gain CLI access when needed. To have sshd in an Alpine Docker container, you're generally need to be running init and a bunch of demons, not just a single standalone service.

    I'm guessing in practice relatively few people are actually exposed. But if they are, it's catastrophic.

  • hypfer  2 days ago

    > Edit 2: You really don't need to look very hard to find public container examples at million-download scale.

    It would be super helpful if you would answer a "what, specifically" question with a "this, specifically" itemized list or not answer at all.

    This is not helpful.