undefined

points

[-]

What is out there that uses musl without PAM and hosts an OpenSSH SSHd with PasswordAuthentication?

Possibly public SFTP servers. I have allowed null passwords in the past for anonymous public SFTP and I run Alpine Linux exclusively for my servers both VM's and physical. The shadow package (PAM) did not get installed by default. I installed it but I had to specify it in the installation so there are likely people without it. There is probably a way to find them on shodan.io.

I will activate one for people to play around with for today:

    sftp hn@ping.ohftp.org

There's no firewall and no password. Hack away HN.

    PasswordAuthentication yes
    PermitEmptyPasswords yes

cd /pub

get so*

by jbyers3 hours ago|

prev|

[-]

A large number of Docker containers?

Edit: Sure, a small minority presumably run sshd under these conditions. But a small minority times the number of Alpine containers running in the world gets to a large absolute number.

Edit 2: You really don't need to look very hard to find public container examples at million-download scale.

by ekidd3 hours ago|

parent|

[-]

Many, many Docker containers rely on "docker exec" or the kubectl equivalent to gain CLI access when needed. To have sshd in an Alpine Docker container, you're generally need to be running init and a bunch of demons, not just a single standalone service.

I'm guessing in practice relatively few people are actually exposed. But if they are, it's catastrophic.

by hypfer1 hours ago|

parent|

prev|

[-]

> Edit 2: You really don't need to look very hard to find public container examples at million-download scale.

It would be super helpful if you would answer a "what, specifically" question with a "this, specifically" itemized list or not answer at all.

This is not helpful.

by hypfer3 hours ago|

parent|

prev|

[-]