schappim/sshole-audit

Find, prove and fix *sshole: the OpenSSH password bypass where any 257-1024 byte password logs into a '*' account on musl libc without PAM. Read-only probe, fleet scanner, dry-run remediation. Also a Claude Code skill.

3 best points · 0 comments · 1 Hacker News post · 1 GitHub stars · View on GitHub

Hacker News discussions

• Show HN: Sshole-audit – Find, prove and fix *sshole: the OpenSSH password bypass (3 points, 0 comments, by schappim, 2026-11-05)