OpenSSH accepts any password

*sshole so openssh on musl linux (alpine, openwrt, buildroot, yocto, and a lot of the docker images you've pulled) has had a little problem since 2016. accounts that should never take a password at all (root, your key-only deploy user, ldap users, the default user on alpine's aws and azure images) take any password longer than 256 characters. yes, any password. yes. i know. yes. $ ssh root@alpine-cloud root@alpine-cloud's password: wrong Permission denied, please try again. root@alpine-cloud's password: AAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Welcome to Alpine!

The meme is a dark-themed technical post about OpenSSH on musl-based Linux distributions accepting passwords longer than 256 characters because of a bug. A terminal shows an SSH login to an Alpine host succeeding after entering a huge string of “A” characters, making the supposedly invalid password work. It is shared as an absurd reaction to bizarre security vulnerabilities and software that accepts exactly what it should reject. EN: The meme is a dark-themed technical post about OpenSSH on musl-based Linux distributions accepting passwords longer than 256 characters because of a bug. A terminal shows an SSH login to an Alpine host succeeding after entering a huge string of “A” characters, making the supposedly invalid password work. It is shared as an absurd reaction to bizarre security vulnerabilities and software that accepts exactly what it should reject.

• @gentoomemes / 22536 2026-11-05