{"id":2189,"date":"2026-11-06T07:22:02","date_gmt":"2026-11-06T00:22:02","guid":{"rendered":"https:\/\/vncybers.vn\/hieu-sshole-mat-khau-dai-mo-khoa-alpine-linux\/"},"modified":"2026-11-06T07:22:02","modified_gmt":"2026-11-06T00:22:02","slug":"understanding-sshole-openssh-alpine-linux","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/hieu-sshole-mat-khau-dai-mo-khoa-alpine-linux\/","title":{"rendered":"Understanding *sshole: How a Long Password Can Unlock Alpine Linux"},"content":{"rendered":"

*sshole<\/strong> l\u00e0 t\u00ean m\u00e0 nh\u00e0 nghi\u00ean c\u1ee9u \u00d6zg\u00fcn K\u00fcltekin \u0111\u1eb7t cho m\u1ed9t l\u1ed7i b\u1ecf qua x\u00e1c th\u1ef1c m\u1eadt kh\u1ea9u trong OpenSSH tr\u00ean m\u1ed9t s\u1ed1 h\u1ec7 th\u1ed1ng Linux d\u00f9ng musl libc. Trong \u0111i\u1ec1u ki\u1ec7n c\u1ee5 th\u1ec3, k\u1ebb t\u1ea5n c\u00f4ng ch\u1ec9 c\u1ea7n bi\u1ebft t\u00ean t\u00e0i kho\u1ea3n v\u00e0 g\u1eedi m\u1ed9t m\u1eadt kh\u1ea9u d\u00e0i t\u1eeb 257 \u0111\u1ebfn 1.024 byte \u0111\u1ec3 \u0111\u0103ng nh\u1eadp v\u00e0o t\u00e0i kho\u1ea3n v\u1ed1n kh\u00f4ng \u0111\u01b0\u1ee3c ph\u00e9p d\u00f9ng m\u1eadt kh\u1ea9u. OpenSSH 10.6p2 v\u00e0 c\u00e1c g\u00f3i Alpine Linux \u0111\u00e3 v\u00e1 l\u1ed7i ng\u00e0y 5\/11\/2026.<\/p>\n

V\u1ea5n \u0111\u1ec1 \u0111\u00e1ng ch\u00fa \u00fd kh\u00f4ng n\u1eb1m \u1edf m\u1ed9t thu\u1eadt to\u00e1n m\u00e3 h\u00f3a y\u1ebfu, m\u00e0 \u1edf c\u00e1ch ba l\u1ef1a ch\u1ecdn h\u1ee3p l\u00fd \u1edf ba th\u1eddi \u0111i\u1ec3m kh\u00e1c nhau t\u01b0\u01a1ng t\u00e1c v\u1edbi nhau: k\u00fd t\u1ef1 *<\/code> d\u00f9ng \u0111\u1ec3 kh\u00f3a m\u1eadt kh\u1ea9u, gi\u00e1 tr\u1ecb l\u1ed7i c\u1ee7a h\u00e0m crypt()<\/code> trong musl v\u00e0 c\u01a1 ch\u1ebf ch\u1ed1ng d\u00f2 t\u00ean ng\u01b0\u1eddi d\u00f9ng c\u1ee7a OpenSSH. \u0110\u00e2y l\u00e0 b\u00e0i h\u1ecdc \u0111i\u1ec3n h\u00ecnh v\u1ec1 r\u1ee7i ro t\u1ea1i ranh gi\u1edbi gi\u1eefa c\u00e1c th\u00e0nh ph\u1ea7n ph\u1ea7n m\u1ec1m.<\/p>\n

How does *sshole work?<\/h2>\n

Tr\u00ean Linux, tr\u01b0\u1eddng m\u1eadt kh\u1ea9u trong \/etc\/shadow<\/code> th\u01b0\u1eddng ch\u1ee9a m\u1ed9t chu\u1ed7i b\u0103m c\u00f3 ti\u1ec1n t\u1ed1 nh\u01b0 $6$<\/code> cho SHA-512. V\u1edbi t\u00e0i kho\u1ea3n ch\u1ec9 \u0111\u0103ng nh\u1eadp b\u1eb1ng kh\u00f3a SSH, qu\u1ea3n tr\u1ecb vi\u00ean c\u00f3 th\u1ec3 \u0111\u1eb7t tr\u01b0\u1eddng n\u00e0y th\u00e0nh *<\/code>; v\u00ec \u0111\u00e2y kh\u00f4ng ph\u1ea3i chu\u1ed7i b\u0103m h\u1ee3p l\u1ec7, v\u1ec1 nguy\u00ean t\u1eafc kh\u00f4ng m\u1eadt kh\u1ea9u n\u00e0o kh\u1edbp \u0111\u01b0\u1ee3c.<\/p>\n

Tr\u00ean musl libc, crypt()<\/code> c\u0169ng tr\u1ea3 v\u1ec1 \u0111\u00fang k\u00fd t\u1ef1 *<\/code> khi vi\u1ec7c b\u0103m th\u1ea5t b\u1ea1i. Thu\u1eadt to\u00e1n SHA-512 crypt c\u1ee7a musl gi\u1edbi h\u1ea1n \u0111\u1ea7u v\u00e0o \u1edf 256 byte \u0111\u1ec3 tr\u00e1nh t\u00e1c v\u1ee5 b\u0103m qu\u00e1 t\u1ed1n t\u00e0i nguy\u00ean. Khi nh\u1eadn m\u1eadt kh\u1ea9u d\u00e0i h\u01a1n gi\u1edbi h\u1ea1n, h\u00e0m tr\u1ea3 v\u1ec1 *<\/code>. N\u1ebfu OpenSSH so s\u00e1nh k\u1ebft qu\u1ea3 \u0111\u00f3 v\u1edbi tr\u01b0\u1eddng m\u1eadt kh\u1ea9u *<\/code> c\u1ee7a t\u00e0i kho\u1ea3n, hai chu\u1ed7i tr\u00f9ng nhau v\u00e0 x\u00e1c th\u1ef1c c\u00f3 th\u1ec3 th\u00e0nh c\u00f4ng.<\/p>\n

\"OpenSSH
OpenSSH code involved in the chain of conditions behind *sshole. Source: \u00d6zg\u00fcn K\u00fcltekin's research at sshhole.com.<\/figcaption><\/figure>\n

Why does OpenSSH hash a password for a locked account?<\/h2>\n

N\u0103m 2016, OpenSSH s\u1eeda CVE-2016-6210, m\u1ed9t k\u00eanh b\u00ean cho ph\u00e9p \u0111o th\u1eddi gian ph\u1ea3n h\u1ed3i \u0111\u1ec3 suy \u0111o\u00e1n t\u00ean ng\u01b0\u1eddi d\u00f9ng c\u00f3 t\u1ed3n t\u1ea1i hay kh\u00f4ng. \u0110\u1ec3 c\u00e1c \u0111\u01b0\u1eddng x\u1eed l\u00fd m\u1ea5t th\u1eddi gian g\u1ea7n t\u01b0\u01a1ng \u0111\u01b0\u01a1ng, sshd<\/code> v\u1eabn th\u1ef1c hi\u1ec7n ph\u00e9p b\u0103m cho ng\u01b0\u1eddi d\u00f9ng kh\u00f4ng h\u1ee3p l\u1ec7 ho\u1eb7c t\u00e0i kho\u1ea3n kh\u00f4ng c\u00f3 chu\u1ed7i b\u0103m d\u00f9ng \u0111\u01b0\u1ee3c, b\u1eb1ng c\u00e1ch m\u01b0\u1ee3n salt t\u1eeb t\u00e0i kho\u1ea3n kh\u00e1c.<\/p>\n

C\u01a1 ch\u1ebf ch\u1ed1ng d\u00f2 t\u00ean ng\u01b0\u1eddi d\u00f9ng n\u00e0y kh\u00f4ng t\u1ef1 n\u00f3 t\u1ea1o ra l\u1ed7 h\u1ed5ng. L\u1ed7i xu\u1ea5t hi\u1ec7n khi n\u00f3 g\u1eb7p \u0111\u00fang h\u00e0nh vi tr\u1ea3 v\u1ec1 *<\/code> c\u1ee7a musl v\u00e0 t\u00e0i kho\u1ea3n c\u00f3 tr\u01b0\u1eddng m\u1eadt kh\u1ea9u c\u0169ng l\u00e0 *<\/code>. OpenSSH \u0111\u00e1nh gi\u00e1 nguy\u00ean nh\u00e2n g\u1ed1c n\u1eb1m ngo\u00e0i sshd<\/code>, nh\u01b0ng \u0111\u00e3 b\u1ed5 sung bi\u1ec7n ph\u00e1p tr\u00e1nh khai th\u00e1c trong b\u1ea3n 10.6p2.<\/p>\n

Which systems are at risk?<\/h2>\n

According to Alpine Linux's official advisory, all of these conditions must be true:<\/p>\n

    \n
  • OpenSSH runs on a musl-based Linux system, most notably Alpine Linux; OpenWrt, Buildroot, and Yocto environments should also verify their actual configuration.<\/li>\n
  • PAM b\u1ecb t\u1eaft. G\u00f3i openssh-server<\/code> m\u1eb7c \u0111\u1ecbnh c\u1ee7a Alpine kh\u00f4ng d\u00f9ng PAM; openssh-server-pam<\/code> v\u1edbi UsePAM yes<\/code> kh\u00f4ng b\u1ecb \u1ea3nh h\u01b0\u1edfng.<\/li>\n
  • PasswordAuthentication yes<\/code> v\u1eabn \u0111\u01b0\u1ee3c b\u1eadt.<\/li>\n
  • C\u00f3 \u00edt nh\u1ea5t m\u1ed9t t\u00e0i kho\u1ea3n v\u1edbi tr\u01b0\u1eddng m\u1eadt kh\u1ea9u l\u00e0 *<\/code> v\u00e0 \u00edt nh\u1ea5t m\u1ed9t t\u00e0i kho\u1ea3n kh\u00e1c d\u00f9ng chu\u1ed7i b\u0103m $5$<\/code> or $6$<\/code>.<\/li>\n<\/ul>\n

    Debian, Ubuntu v\u00e0 Fedora d\u00f9ng glibc, c\u00e1c m\u00e1y \u0111i qua PAM, h\u1ec7 th\u1ed1ng \u0111\u00e3 t\u1eaft \u0111\u0103ng nh\u1eadp m\u1eadt kh\u1ea9u v\u00e0 container kh\u00f4ng ch\u1ea1y sshd<\/code> kh\u00f4ng n\u1eb1m trong ph\u1ea1m vi n\u00e0y. T\u00e0i kho\u1ea3n c\u00f3 tr\u01b0\u1eddng !<\/code> c\u0169ng kh\u00f4ng ch\u1ecbu c\u00e1ch khai th\u00e1c tr\u00ean. V\u00ec v\u1eady, vi\u1ec7c ch\u1ec9 th\u1ea5y Alpine trong chu\u1ed7i cung \u1ee9ng container ch\u01b0a \u0111\u1ee7 \u0111\u1ec3 k\u1ebft lu\u1eadn m\u00e1y ch\u1ee7 c\u00f3 th\u1ec3 b\u1ecb t\u1ea5n c\u00f4ng.<\/p>\n

    Special risk for Alpine cloud images<\/h2>\n

    C\u00e1c \u1ea3nh tiny-cloud ch\u00ednh th\u1ee9c t\u1eeb Alpine 3.18.11 \u0111\u1ebfn 3.24.3 c\u00f3 t\u00e0i kho\u1ea3n alpine<\/code> v\u1edbi tr\u01b0\u1eddng m\u1eadt kh\u1ea9u *<\/code> v\u00e0 quy\u1ec1n doas<\/code> kh\u00f4ng c\u1ea7n m\u1eadt kh\u1ea9u. \u1ea2nh m\u1edbi kh\u1edfi \u0111\u1ed9ng v\u1eabn an to\u00e0n khi cloud-init t\u1eaft x\u00e1c th\u1ef1c m\u1eadt kh\u1ea9u. Tuy nhi\u00ean, n\u1ebfu c\u1ea5u h\u00ecnh sau \u0111\u00f3 b\u1eadt \u0111\u0103ng nh\u1eadp m\u1eadt kh\u1ea9u v\u00e0 xu\u1ea5t hi\u1ec7n m\u1ed9t chu\u1ed7i b\u0103m $6$<\/code>, k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 l\u1ea5y shell c\u1ee7a t\u00e0i kho\u1ea3n alpine<\/code> r\u1ed3i n\u00e2ng quy\u1ec1n l\u00ean root.<\/p>\n

    Alpine says every checked branch from 3.16 through 3.24 and edge was affected in older package versions. The project also issued fixes for some unsupported branches, but administrators should not use that as a reason to postpone an operating-system upgrade.<\/p>\n

    How to patch and mitigate safely<\/h2>\n

    The preferred response is to update all packages and restart SSH:<\/p>\n

    apk upgrade -U -a\nrc-service sshd restart<\/code><\/pre>\n
    Ch\u1ec9 n\u00e2ng c\u1ea5p g\u00f3i l\u00e0 ch\u01b0a \u0111\u1ee7 v\u00ec ti\u1ebfn tr\u00ecnh sshd<\/code> \u0111ang ch\u1ea1y kh\u00f4ng t\u1ef1 \u0111\u01b0\u1ee3c thay th\u1ebf. C\u00e1c b\u1ea3n Alpine 3.21.10, 3.22.8, 3.23.8 v\u00e0 3.24.4 \u0111\u00e3 ch\u1ee9a g\u00f3i s\u1eeda; nh\u00e1nh edge d\u00f9ng OpenSSH 10.6_p2-r0.<\/p>\n
    N\u1ebfu ch\u01b0a th\u1ec3 c\u1eadp nh\u1eadt ngay, h\u00e3y x\u00e1c nh\u1eadn \u0111\u0103ng nh\u1eadp b\u1eb1ng kh\u00f3a ho\u1ea1t \u0111\u1ed9ng, gi\u1eef phi\u00ean qu\u1ea3n tr\u1ecb hi\u1ec7n t\u1ea1i m\u1edf, sau \u0111\u00f3 \u0111\u1eb7t PasswordAuthentication no<\/code>, ki\u1ec3m tra c\u1ea5u h\u00ecnh b\u1eb1ng sshd -t<\/code> v\u00e0 kh\u1edfi \u0111\u1ed9ng l\u1ea1i d\u1ecbch v\u1ee5. Kh\u00f4ng n\u00ean \u0111\u00f3ng phi\u00ean hi\u1ec7n t\u1ea1i tr\u01b0\u1edbc khi th\u1eed th\u00e0nh c\u00f4ng m\u1ed9t k\u1ebft n\u1ed1i SSH m\u1edbi \u0111\u1ec3 tr\u00e1nh t\u1ef1 kh\u00f3a m\u00ecnh kh\u1ecfi m\u00e1y ch\u1ee7.<\/p>\n
    How to check for exploitation<\/h2>\n
    Tr\u00ean Alpine, qu\u1ea3n tr\u1ecb vi\u00ean n\u00ean t\u00ecm c\u00e1c d\u00f2ng Accepted password<\/code> trong \/var\/log\/messages<\/code>, \u0111\u1eb7c bi\u1ec7t v\u1edbi alpine<\/code>, root<\/code> ho\u1eb7c t\u00e0i kho\u1ea3n v\u1ed1n ch\u1ec9 d\u00f9ng kh\u00f3a. M\u1ed9t l\u1ea7n \u0111\u0103ng nh\u1eadp m\u1eadt kh\u1ea9u th\u00e0nh c\u00f4ng cho t\u00e0i kho\u1ea3n c\u00f3 tr\u01b0\u1eddng *<\/code> l\u00e0 d\u1ea5u hi\u1ec7u nghi\u00eam tr\u1ecdng.<\/p>\n
    N\u1ebfu kh\u00f4ng th\u1ec3 lo\u1ea1i tr\u1eeb x\u00e2m nh\u1eadp, c\u1ea7n x\u1eed l\u00fd m\u00e1y nh\u01b0 \u0111\u00e3 b\u1ecb chi\u1ebfm quy\u1ec1n: c\u00f4 l\u1eadp, b\u1ea3o to\u00e0n log, r\u00e0 so\u00e1t l\u1ec7nh doas<\/code>, t\u00e0i kho\u1ea3n v\u00e0 t\u1ec7p m\u1edbi, kh\u00f3a trong authorized_keys<\/code>, ti\u1ebfn tr\u00ecnh duy tr\u00ec truy c\u1eadp v\u00e0 th\u00f4ng tin x\u00e1c th\u1ef1c c\u00f3 m\u1eb7t tr\u00ean m\u00e1y. Vi\u1ec7c v\u00e1 ch\u1ec9 ch\u1eb7n l\u1ea7n khai th\u00e1c ti\u1ebfp theo, kh\u00f4ng lo\u1ea1i b\u1ecf c\u1eeda h\u1eadu \u0111\u00e3 \u0111\u01b0\u1ee3c c\u00e0i.<\/p>\n
    A flaw that survived for ten years<\/h2>\n
    Chu\u1ed7i nguy\u00ean nh\u00e2n k\u00e9o d\u00e0i t\u1eeb quy\u1ebft \u0111\u1ecbnh c\u1ee7a musl n\u0103m 2012, b\u1ea3n v\u00e1 ch\u1ed1ng d\u00f2 ng\u01b0\u1eddi d\u00f9ng c\u1ee7a OpenSSH n\u0103m 2016 \u0111\u1ebfn c\u00e1ch Alpine d\u00f9ng *<\/code> cho t\u00e0i kho\u1ea3n ch\u1ec9 d\u00f9ng kh\u00f3a t\u1eeb n\u0103m 2022. Nh\u00e0 nghi\u00ean c\u1ee9u ph\u00e1t hi\u1ec7n sai kh\u00e1c khi th\u1eed kho\u1ea3ng 17.600 tr\u01b0\u1eddng h\u1ee3p x\u00e1c th\u1ef1c tr\u00ean nhi\u1ec1u t\u1ed5 h\u1ee3p glibc, musl, PAM v\u00e0 shadow.<\/p>\n
    When Alpine published its advisory, it said no CVE had been assigned. Some later reports call the issue CVE-2026-123158, but administrators should prioritize Alpine's advisory and the OpenSSH 10.6p2 release notes until official CVE databases are fully synchronized.<\/p>\n
    Lessons for operations teams<\/h2>\n
    *sshole shows that testing each library in isolation is not enough to secure a complete system. An error value that seems harmless in musl can become a valid authentication result when combined with OpenSSH logic and account data. Operations teams should test real configuration matrices, track differences between libc and PAM, and remove password authentication from key-only servers.<\/p>\n
    \u01afu ti\u00ean t\u1ee9c th\u1eddi l\u00e0 ki\u1ec3m k\u00ea m\u00e1y Alpine c\u00f3 m\u1edf c\u1ed5ng SSH, c\u1eadp nh\u1eadt v\u00e0 kh\u1edfi \u0111\u1ed9ng l\u1ea1i sshd<\/code>, x\u00e1c minh c\u1ea5u h\u00ecnh hi\u1ec7u l\u1ef1c b\u1eb1ng sshd -T<\/code>, r\u1ed3i r\u00e0 so\u00e1t log. \u0110\u00e2y l\u00e0 m\u1ed9t l\u1ed7i c\u00f3 \u0111i\u1ec1u ki\u1ec7n khai th\u00e1c h\u1eb9p, nh\u01b0ng khi c\u00e1c \u0111i\u1ec1u ki\u1ec7n h\u1ed9i \u0111\u1ee7, t\u00e1c \u0111\u1ed9ng c\u00f3 th\u1ec3 l\u00e0 \u0111\u0103ng nh\u1eadp t\u1eeb xa v\u00e0 chi\u1ebfm quy\u1ec1n root ch\u1ec9 trong m\u1ed9t k\u1ebft n\u1ed1i.<\/p>\n
    VNCyberS<\/strong> compiled from Alpine Linux, OpenSSH, sshhole.com, and BleepingComputer<\/em><\/p>","protected":false},"excerpt":{"rendered":"
    *sshole l\u00e0 t\u00ean m\u00e0 nh\u00e0 nghi\u00ean c\u1ee9u \u00d6zg\u00fcn K\u00fcltekin \u0111\u1eb7t cho m\u1ed9t l\u1ed7i b\u1ecf qua x\u00e1c th\u1ef1c m\u1eadt kh\u1ea9u trong OpenSSH tr\u00ean m\u1ed9t s\u1ed1 h\u1ec7 th\u1ed1ng Linux d\u00f9ng musl libc. Trong \u0111i\u1ec1u ki\u1ec7n c\u1ee5 th\u1ec3, k\u1ebb t\u1ea5n c\u00f4ng ch\u1ec9 c\u1ea7n bi\u1ebft t\u00ean t\u00e0i kho\u1ea3n v\u00e0 g\u1eedi m\u1ed9t m\u1eadt kh\u1ea9u d\u00e0i t\u1eeb 257 \u0111\u1ebfn 1.024 byte […]<\/p>\n","protected":false},"author":2,"featured_media":2188,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5],"tags":[1076,1078,46,1083,1082,1079,1077,1081,419,1080],"class_list":["post-2189","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-kien-thuc","tag-sshole","tag-alpine-linux","tag-an-ninh-mang","tag-cve-2016-6210","tag-linux","tag-musl-libc","tag-openssh","tag-passwordauthentication","tag-quan-tri-may-chu","tag-xac-thuc-ssh"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2189","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=2189"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2189\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/2188"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=2189"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=2189"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=2189"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}