Documentation
¶
Overview ¶
Package sshole is the detector for *sshole, the OpenSSH password authentication bypass on musl libc fixed in OpenSSH 10.6p2 (commit 4353fdc43, 2026-11-05) and in Alpine's openssh packages the same day. On musl, sshd before the fix compares an account's password field of "*" with the "*" that musl's crypt returns when it fails, so a password that makes crypt fail logs in to that account.
It finds OpenSSH servers in filesystems and container images, judges each by its C library, its release and the apk database, and then checks what the target's sshd_config and account files make reachable. It also checks live servers (what a banner and the offered methods can tell) and the Dockerfiles and scripts in a source tree.
internal/assess knows nothing about the engine; this file adapts it.
Index ¶
- Constants
- type Detector
- func (d *Detector) Fix(ctx context.Context, dirs []string, o engine.Options, stdout, stderr io.Writer) int
- func (d *Detector) Load() error
- func (d *Detector) Manifest() engine.Manifest
- func (d *Detector) NewScan(kind engine.TargetKind) engine.Scan
- func (d *Detector) Probe(ctx context.Context, addr string, timeout time.Duration) (string, int, []engine.Finding, error)
- func (d *Detector) ScanRepo(ctx context.Context, dir string, o engine.Options) *engine.Target
- func (d *Detector) Wants(p string, head []byte, _ bool) bool
Constants ¶
const ( KindAPKPin = repo.RulePin KindAPKFloor = repo.RuleUnpinned KindEOL = repo.RuleEOL KindStar = repo.RuleStar KindPassword = repo.RulePassword KindNotChecked = repo.RuleNotChecked )
Kind IDs for a source tree.
const ( KindExposed = assess.KindExposed KindServer = assess.KindServer KindHost = "host" )
Kind IDs.
const ID = "sshole"
ID is the detector's ID.
const KindImage = "image"
KindImage: an image the source tree builds on or deploys holds an OpenSSH server exposed to *sshole.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Detector ¶
type Detector struct{}
Detector implements engine.Detector, engine.Reader, engine.Prober, engine.RepoScanner and engine.Fixer.
func (*Detector) Fix ¶
func (d *Detector) Fix(ctx context.Context, dirs []string, o engine.Options, stdout, stderr io.Writer) int
Fix rewrites what can be fixed: apk constraints to the fixed release and "*" password fields to "*NP*". Each edit is rescanned in memory first.
func (*Detector) NewScan ¶
func (d *Detector) NewScan(kind engine.TargetKind) engine.Scan
NewScan starts a filesystem or image scan.
func (*Detector) Probe ¶
func (d *Detector) Probe(ctx context.Context, addr string, timeout time.Duration) (string, int, []engine.Finding, error)
Probe connects to an SSH server (default port 22), reads its banner and asks which authentication methods it offers. It sends no password: when the server offers password logins, the client stops there.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
internal
|
|
|
assess
Package assess decides whether an OpenSSH server is exposed to *sshole: on musl libc, sshd before 10.6p2 compares a password field of "*" with crypt's failure result "*", so a password that makes crypt fail logs in.
|
Package assess decides whether an OpenSSH server is exposed to *sshole: on musl libc, sshd before 10.6p2 compares a password field of "*" with crypt's failure result "*", so a password that makes crypt fail logs in. |
|
repo
Package repo finds what in a source tree builds or configures an OpenSSH server exposed to *sshole, and plans the edits that fix it:
|
Package repo finds what in a source tree builds or configures an OpenSSH server exposed to *sshole, and plans the edits that fix it: |
|
testelf
Package testelf builds the small ELF executables the sshole tests read.
|
Package testelf builds the small ELF executables the sshole tests read. |