SSHole

What the actual …? On some Alpine Linux systems running OpenSSH, an overly long password could get you into an account that only accepted SSH keys.

The password hashing code in crypt() returned * when it failed. The account also stored * to mean “no password login.” OpenSSH saw a match and let the login through.

I’m glad this got a clear public write-up. The timeline shows how the pieces fell into place over the years, and this Hacker News comment walks through exactly how the check went wrong.