Sshole

In 1980, Bill Joy introduced a * symbol for an account called daemon in Unix, which was not accessible via login. The real names followed in the next field, with the password hash stored in /etc/shadow. Typing a password would hash it with the same salt and compare the result to the stored hash. If the field contained a * symbol, there was nothing to match, rendering any password incorrect.

However, some programs did not check for NULL and crashed instead. To prevent this, musl libc, used in Alpine Linux, modified crypt() to return a single character that could never match a real password. Additionally, musl capped the password length at 256 bytes to avoid server slowdowns caused by longer passwords. In 2016, CVE-2016-6210 was discovered, where a time-consuming hash calculation was used to determine if a user existed, leading to a noticeable delay for valid users and instant denial for non-existent ones.

In 2019, Alpine Linux faced CVE-2019-5021, where no root password was set, allowing unauthorized access via SSH keys. Alpine addressed this by locking the root account with an exclamation mark (!) but this also hindered SSH key authentication. In 2022, Alpine Linux switched root to a * symbol while locking it, allowing SSH key access once again.

Despite these issues, many distros bypass crypt() checks for passwords starting with *, leading to potential security vulnerabilities.