Linode Customer Security Advisory: OpenSSH Password Authentication Bypass Vulnerability

Nov 5, 17:40 UTC
Resolved - Akamai is aware of the password authentication bypass vulnerability affecting certain Linux systems using musl libc that was recently mitigated by an urgent OpenSSH update. Since Alpine Linux is specifically called out as being affected, we wanted to assure customers that Linode’s Alpine images are not affected by this vulnerability. Linodes using password-less provisioning do not have password authentication enabled by default unless customers change this configuration option in sshd_config after launch, while linodes launched using a password do not have any unlocked user accounts with a password hash set to ‘*’.

However, we would like to use this opportunity as a reminder for customers to consider disabling password authentication permanently in favor of more secure mechanisms such as SSH keys or SSH CA certificates.

Continue reading...

---