⚠ Update your Alpine Linux OpenSSH NOW

Given I talk about Alpine being my Linux server distro of choice, I feel it important to relay this: If you run sshd on Alpine Linux, update openssh now and restart sshd. Upgrading the package alone does not replace the running daemon. If you cannot update yet, at least disable password logins: set PasswordAuthentication no in your sshd configuration and restart sshd. Either one closes the hole. The OpenSSH team were also quick to issue a workaround with 10.6p1: This release contains a critical security workaround that affects Linux systems that use the musl libc and PAM disabled. Note this affects any Linux system that meets these conditions, not just Alpine. If you’re unsure, just patch. It’s been my security posture to always disable OpenSSH password logins (despite a vocal minority claiming I shouldn’t. I forget their tenuous reason, something about letting people waste their time trying passwords). Thanks to everyone for the quick response. Maybe consider donating to Alpine and…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town