Nov 5, 2026, 3:40 PMThe funny thing is that I have an older Alpine 13.5 box on which all the passwords are '!' not '*', which actually seems to prevent this (because the issue is crypt() returning * on error).
- Nov 5, 2026, 3:40 PM
Replies
Danmeph@treehouse.systemsNov 5, 2026, 3:44 PM@lcamtuf another 2 things that seem to prevent this are:
- setting actual passwords on accounts with real shells
- disabling ssh based password auth.
I have always done both on all of my systems, so I was relieved to find out that I'm unaffected this morning. Systems updated.
Geoff Beierpetard@tilde.zoneNov 5, 2026, 3:48 PM@lcamtuf Similar story here. It started as a 3.11 box, and I upgraded it to 3.19 in 2024.
All the passwords are `!` not `*` which I suppose might be a bug in either an upgrade script or my "process" for upgrading it last time I did that.
```
$ cat /etc/alpine-release
3.19.0
```