*sshole: The 257-Character Password That Opened Locked SSH Accounts

A weird collision between OpenSSH, musl, and a single * turned “no password can ever work” into “almost any very long password works”

Every now and then, a vulnerability appears that sounds made up even after you understand it.

*sshole is one of those bugs.

On certain Linux systems, an SSH account that was deliberately configured to reject every password could accept practically any password between 257 and 1,024 characters. The password did not need to be guessed. It did not need to match a hash. It just needed to be long enough.

That sentence needs an important disclaimer: this did not affect every OpenSSH server. The vulnerable path required a specific combination of musl libc, password authentication, PAM being disabled, a locked account represented by *, and another account with a usable SHA-crypt password hash.

Still, that combination is not purely academic. It appears naturally in systems built around Alpine Linux, OpenWrt, Buildroot, Yocto, and other musl-based environments.