My Alpine is safe because I have winter tires
your alpine is vulnerable because you need SSH, my Alpine is vulnerable because its out of date. we are not the same
What is “certicate based authentication” ?
ssh allows you to add trusted public key. When you ssh from a computer that has the private key, it will immediately log you in without asking for your password.
Ok, but what’s a certicate?
Oh, a certicate is a typo that most people miss
Overly basically, it’s a file based way to prove you can log into an account
There is information in file that the computer can verify that you created the certificate on this computer while already having access to this account, therefore you are allowed access.
In most contexts, digital certificates are considered more secure than a password for authentication, so in creating one, it’s a pretty typical thing to disable being able to log in with a password. However, this bug allows account access with a garbage password.
OK, but what’s a certicate?
I’ve never seen one before, no one has… But I’m guessing it’s a white hole.
I think they meant certificate, and are perhaps referencing the eMudhra incident?
No, there was an SSH vulnerability discovered a day or two ago, which allows anyone to bypass the certificate check during authentication. So if your SSH is configured to only use a certificate, (not cert and password) then anyone can log into your shit.
Huh, I must have missed that one. Alpine/musl as well then? Got a ref?
Yes, it specifically affects the OpenSSH/Alpine/musl interaction. It’s a vulnerability in how Alpine/OpenSSH interfaces with musl, and allows anyone who can reach your SSH port to instantly log into a passwordless account by entering over 256 characters into the password field.
The vuln is nicknamed *sshole, if you want to search it. Because it only works on passwordless accounts, (meaning it has a * in the password field). And the most common use-case for passwordless accounts is because you’re using cert-based authentication instead. Thus the warnings that if you’re using cert-only SSH, you’re most likely vulnerable.
I left the alpine face cover one time in my car in the door pocket, and that happened to be the night my car got stolen and they stole it. Not only did they steal the alpine but every single thing I had in my car, even a old blanket I used when we went to the beach all covered in sand
Have you tried opening an issue?
I did with the tow yard, but they insisted I pay them half my cars worth to get it back
