Written by Ajesh Unnithan
If your business runs an Alpine Linux server with SSH enabled, check its OpenSSH package and authentication settings. Alpine Linux published an advisory about a password authentication bypass affecting certain configurations. The priority for affected systems is to install the fixed package and restart the running SSH service. If you cannot update immediately, Alpine recommends disabling SSH password authentication and restarting the service. Alpine Linux security advisory
Which servers should you check first?
Start with Alpine Linux servers that run sshd, allow password authentication and can be reached from the internet. The advisory focuses on Alpine’s OpenSSH server package built without PAM and deployments where the PAM-capable package runs with UsePAM no. It also identifies older official Alpine cloud images as deployments worth checking.
Review running instances, including staging servers and older VPS deployments. Updating the image used for new deployments does not patch instances already running. Containers that do not run sshd are outside the container-specific exposure described in the advisory, but the host’s SSH service should be assessed separately.
On an Alpine server, identify the operating system and installed OpenSSH packages:
cat /etc/os-release
apk info -v openssh openssh-server openssh-server-pamThen inspect the effective SSH server configuration with administrative privileges:
sshd -T | grep -Ei '^(passwordauthentication|usepam|permitrootlogin) 'If your configuration uses Match blocks, check the effective settings for the relevant users and connection sources as well. A general configuration check may not reflect every login path.
Compare your package with Alpine’s fixed version
OpenSSH 10.6p2 contains the upstream workaround. Alpine also backported the correction to earlier package versions, so an upstream version number below 10.6p2 is insufficient to determine whether an Alpine server has been patched. Compare the full package version, including its revision, with the fixed version for your Alpine branch. OpenSSH release notes
| Alpine branch | Fixed openssh package listed in the advisory |
|---|---|
| Edge | 10.6_p2-r0 |
| 3.24 | 10.3_p1-r2 |
| 3.23 | 10.2_p1-r1 |
| 3.22 | 10.0_p1-r11 |
| 3.21 | 9.9_p2-r1 |
| 3.20 | 9.7_p1-r6 |
| 3.19 | 9.6_p1-r3 |
| 3.18 | 9.3_p2-r4 |
| 3.17 | 9.1_p1-r7 |
| 3.16 | 9.0_p1-r6 |
The table records the first fixed package versions in the supplied advisory. Use the current corrected package from your branch’s official repositories. A fix for this issue on an older branch does not restore ongoing security support for that branch. Alpine release announcement
Update OpenSSH and restart the service
Follow Alpine’s update guidance for your release. For a standard Alpine installation managed by OpenRC, the advisory gives these commands to upgrade installed packages and restart SSH:
apk upgrade -U -a
rc-service sshd restartRun them with administrative privileges during an appropriate maintenance window. The upgrade command updates all installed packages, so review its scope before running it on a production system. Keep a working admin session or hosting console available.
After the restart, check that sshd is running, confirm the installed package version and open a fresh SSH session. The restart matters because replacing package files on disk does not replace a daemon that is already running.
If you cannot patch immediately
Alpine recommends disabling SSH password authentication as an interim measure:
PasswordAuthentication noBefore changing the setting, confirm that key-based login works and that you can recover access through your hosting console. Keep your existing SSH session open. Apply the setting in the configuration your server actually loads, validate it, restart SSH and test a second connection.
sshd -t
rc-service sshd restart
sshd -T | grep -i '^passwordauthentication 'The last command should show passwordauthentication no. Review any settings that apply only to particular users or connections. Where practical, restrict SSH access to trusted management IP addresses or a private management network while arranging the update.
What about Plesk, cPanel and managed hosting?
Start with the operating system and SSH package underneath the control panel. For systems running another Linux distribution, use that distribution’s security advisory and package guidance.
If a hosting company manages your server, ask for a specific answer:
Please confirm the operating system and OpenSSH package on our server, whether it falls within the scope of the Alpine SSH advisory, and whether the fixed package was installed and the running SSH service restarted.
That gives you a record of both the package update and the service restart.
How to check for suspicious access
On Alpine, review /var/log/messages and any central logs that collect SSH authentication events. Look for successful password logins on accounts intended for key-only access, unfamiliar source IP addresses and unexpected login times. Also review newly added users, SSH keys, privilege changes, scheduled tasks and unexpected modifications to applications or websites.
If you find an unexplained login, preserve the relevant logs and restrict network access where practical. Investigate from a trusted device. If unauthorised access is suspected, have an incident responder assess the scope and determine which credentials to revoke or rotate and whether the server needs to be rebuilt. A package update closes the documented weakness, while the log review helps you assess earlier exposure.
For businesses running Alpine, the immediate tasks are to check the package against Alpine’s fixed version, restart SSH after updating, and review successful login records on exposed servers.
For help coordinating a review of your website or hosting setup, get in touch.
0 Comments