{"id":184154,"date":"2026-11-05T23:41:11","date_gmt":"2026-11-05T21:41:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/sshole-uyazvimost-pozvolyayushhaya-podklyuchitsya-po-ssh-bez-parolya-v-sistemah-s-musl"},"modified":"2026-11-05T23:41:15","modified_gmt":"2026-11-05T21:41:15","slug":"sshole-vulnerability-allows-passwordless-ssh-access-on-musl-based-systems","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/sshole-vulnerability-allows-passwordless-ssh-access-on-musl-based-systems","title":{"rendered":"SSHole \u2014 zranitelnost, kter\u00e1 umo\u017e\u0148uje p\u0159ipojen\u00ed p\u0159es SSH bez hesla v syst\u00e9mech s Musl","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdvoj\u00e1\u0159i OpenSSH zve\u0159ejnili urgentn\u00ed aktualizaci OpenSSH 10.6p2, kter\u00e1 p\u0159id\u00e1v\u00e1 ochranu p\u0159ed kritickou zranitelnost\u00ed (CVE nebyla p\u0159i\u0159azena), ozna\u010dovanou k\u00f3dov\u00fdm n\u00e1zvem \u201eSSHole\u201c, je\u017e umo\u017e\u0148uje obej\u00edt autentizaci. V syst\u00e9mech s knihovnou Musl zranitelnost umo\u017e\u0148uje p\u0159ipojit se k u\u017eivatelsk\u00e9mu \u00fa\u010dtu, pro kter\u00fd nen\u00ed nastaveno heslo, zad\u00e1n\u00edm jak\u00e9hokoli hesla, kter\u00e9 obsahuje v\u00edce ne\u017e 256 znak\u016f. Probl\u00e9m se t\u00fdk\u00e1 distribuc\u00ed Linuxu, kter\u00e9 pou\u017e\u00edvaj\u00ed standardn\u00ed knihovnu musl, ale ne vyu\u017e\u00edvaj\u00ed PAM (Pluggable Authentication Modules), jako jsou OpenWRT, Alpine, Buildroot a Yocto. Obzvl\u00e1\u0161tn\u00ed nebezpe\u010d\u00ed p\u0159edstavuje skute\u010dnost, \u017ee \u010dasto je p\u0159ihl\u00e1\u0161en\u00ed pomoc\u00ed hesla pro u\u017eivatele root blokov\u00e1no, co\u017e umo\u017e\u0148uje komukoli se vzd\u00e1len\u011b p\u0159ipojit s administr\u00e1torsk\u00fdmi pr\u00e1vy.<\/p>\n

Chyba, kter\u00e1 vede k zranitelnosti, nen\u00ed v k\u00f3du OpenSSH, ale je vyko\u0159is\u0165ov\u00e1na p\u0159es sshd. Vzhledem k z\u00e1va\u017enosti probl\u00e9mu byla v verzi OpenSSH 10.6p2 navr\u017eena obchvatn\u00e1 varianta blokov\u00e1n\u00ed zranitelnosti. Vlastn\u00edk\u016fm posti\u017een\u00fdch syst\u00e9m\u016f se doporu\u010duje ne\u010dekat na vyd\u00e1n\u00ed aktualizac\u00ed, ale okam\u017eit\u011b zak\u00e1zat autentizaci pomoc\u00ed hesla nastavov\u00e1n\u00edm parametru \u201ePasswordAuthentication no\u201c v \/etc\/ssh\/sshd_config nebo zcela vypnout SSH. <\/p>\n

Probl\u00e9m se neprojevuje v syst\u00e9mech mimo Linux a v linuxov\u00fdch prost\u0159ed\u00edch zalo\u017een\u00fdch na glibc, ani v syst\u00e9mech, kter\u00e9 pou\u017e\u00edvaj\u00ed PAM p\u0159i autentizaci heslem. Oprava je ji\u017e dostupn\u00e1 v Alpine a OpenWRT.<\/p>\n

Zranitelnost souvis\u00ed s nespr\u00e1vnou interakc\u00ed OpenSSH a funkce crypt() z musl. Pro ochranu p\u0159ed ur\u010den\u00edm existuj\u00edc\u00edch u\u017eivatel\u016f anal\u00fdzou rozd\u00edl\u016f v \u010dase zpracov\u00e1n\u00ed dotaz\u016f od roku 2016 OpenSSH p\u0159i kontrole bezheslov\u00fdch u\u017eivatelsk\u00fdch \u00fa\u010dt\u016f pou\u017e\u00edv\u00e1 standardn\u00ed postup ov\u011b\u0159ov\u00e1n\u00ed hesla: zavol\u00e1 funkci \u201ecrypt(p\u0159ed\u00e1van\u00e9 heslo, s\u016fl)\u201c se sol\u00ed jin\u00e9ho u\u017eivatele, kter\u00fd m\u00e1 platn\u00fd hash hesla, a pot\u00e9 porovn\u00e1 hash vr\u00e1cen\u00fd funkc\u00ed crypt s hodnotou v poli s hashem hesla.<\/p>\n

Nicm\u00e9n\u011b v musl funkce crypt() pro hashe SHA-512 vrac\u00ed znak \u201e*\u201c, pokud d\u00e9lka p\u0159edan\u00e9ho hesla p\u0159esahuje 256 bajt\u016f (omezen\u00ed bylo zaveden\u00e9 v roce 2012 pro ochranu proti DoS \u00fatok\u016fm, proto\u017ee p\u0159i p\u0159ed\u00e1v\u00e1n\u00ed velk\u00fdch hodnot vznik\u00e1 velk\u00e1 z\u00e1t\u011b\u017e na CPU). Ten sam\u00fd znak se pou\u017e\u00edv\u00e1 v poli s hashem hesla v \u201e\/etc\/shadow\u201c k ozna\u010den\u00ed \u00fa\u010dt\u016f, pro kter\u00e9 je autentizace pomoc\u00ed hesla zablokov\u00e1na. <\/p>\n

V d\u016fsledku \u00fatoku m\u016f\u017ee \u00fato\u010dn\u00edk, kter\u00fd se m\u016f\u017ee p\u0159ipojit k SSH serveru, z\u00edskat p\u0159\u00edstup k jak\u00e9koli u\u017eivatelsk\u00e9 \u00fa\u010dtu, u kter\u00e9 je v «\/etc\/shadow» v poli hesla uveden symbol «*», p\u0159i\u010dem\u017e p\u0159ed\u00e1 \u0159et\u011bzec dlouh\u00fd od 257 do 1024 bajt\u016f. Probl\u00e9m se t\u00fdk\u00e1 mnoha existuj\u00edc\u00edch Docker obraz\u016f, kter\u00e9 byly vytvo\u0159eny s vyu\u017eit\u00edm Alpine Linux, a tak\u00e9 standardn\u00edch obraz\u016f Alpine pro cloudov\u00e9 syst\u00e9my AWS a Azure, ve kter\u00fdch je u\u017eivateli root m\u00edsto hashe hesla nastaven znak «*». <\/p>\n

Je pozoruhodn\u00e9, \u017ee v ofici\u00e1ln\u00edch Docker obrazech pou\u017e\u00edvaj\u00edc\u00edch Alpine byl od roku 2015 nastaven pr\u00e1zdn\u00fd root heslo, a po zji\u0161t\u011bn\u00ed t\u00e9to skute\u010dnosti byl m\u00edsto hashe hesla nastaven znak «!». To v\u0161ak zablokovalo p\u0159\u00edstup pomoc\u00ed SSH kl\u00ed\u010d\u016f, tak\u017ee od roku 2022 byl znak pro blokaci p\u0159\u00edstupu p\u0159es heslo zm\u011bn\u011bn na «*».
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 OpenSSH \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 OpenSSH 10.6p2, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0430 \u043e\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE \u043d\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d), \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0439 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f «SSHole» \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e. \u0412 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u043e\u0439 Musl \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043d\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043f\u0430\u0440\u043e\u043b\u044c, \u0432\u0432\u0435\u0434\u044f \u043b\u044e\u0431\u043e\u0439 \u043f\u0430\u0440\u043e\u043b\u044c, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u0431\u043e\u043b\u044c\u0448\u0435 \u0447\u0435\u043c 256 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b Linux, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u0443\u044e \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184154","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SSHole \u2014 zranitelnost, kter\u00e1 umo\u017e\u0148uje p\u0159ipojen\u00ed p\u0159es SSH bez hesla v syst\u00e9mech s Musl | ProHoster","description":"V\u00fdvoj\u00e1\u0159i OpenSSH zve\u0159ejnili nal\u00e9havou aktualizaci OpenSSH 10.6p2, kter\u00e1 p\u0159id\u00e1v\u00e1 ochranu proti kritick\u00e9 zranitelnosti (CVE nebyla ur\u010dena), p\u0159ezd\u00edvan\u00e9 \"SSHole\", kter\u00e1 umo\u017e\u0148uje obej\u00edt autentizaci.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/sshole-vulnerability-allows-passwordless-ssh-access-on-musl-based-systems","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SSHole \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043f\u043e SSH \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 Musl | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 OpenSSH \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 OpenSSH 10.6p2, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0430 \u043e\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE \u043d\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d), \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0439 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f "SSHole" \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/sshole-vulnerability-allows-passwordless-ssh-access-on-musl-based-systems","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-11-05T21:41:11+00:00","article:modified_time":"2026-11-05T21:41:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/184154","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=184154"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/184154\/revisions"}],"predecessor-version":[{"id":184155,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/184154\/revisions\/184155"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=184154"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=184154"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=184154"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}