How many alpine installs are running sshd? Most containers using it as a base image aren't. Embedded Linux is unlikely to be running it, too. And if one IS running sshd, how often is it with unchanged defaults? I don't buy the inference here.
replyI'll concede that embedded linux might be my blindspot here. Maybe cheap web hosting, too, but that seems much less likely to be using musl.
Embedded linux is your blindspot here.
replyMost embedded systems I've seen use glibc or uClibc. I agree it would make sense for them to use musl, but the embedded space moves very slowly.
replyYes
replyA lot of embedded systems use musl and no PAM. Some of them might use Alpine, but the distribution doesn't matter that much.
replyMost of those would be using dropbear rather than openssh.
replyAnd ssh? I'd assume most would use proprietary or industry-specific standard for data IO, or just https, for domestic IoT stuff
replyAnd also ssh in many cases.
replyI thought Dropbear was pretty much the defacto SSH server for embedded applications, is OpenSSH+musl actually a common combination for these scenarios?
reply> > - password logins enabled
reply> The default. Super common.
This always seems bonkers to me. I think SSHD should give you ONE password free connection of setup to copy your key over and then it just shuts the door behind it.
I think it has to be a time limited FREE offer. (like, seriously, what if the user doesn't take the offer?)
replyIt might actually a good idea, but I would likely avoid it since my built-in Bayesian filter would just mark it as spam.