Linux phones? PostmarketOS is alpine-based. And a lot of people may ssh to their phone.
Comment on Update all your stuff, NOW - again.
tofu@lemmy.nocturnal.garden 2 days ago
I mean, not that it’s not severe, but which container images have ssh baked in? If you’re using good stripped down images, you’re fine here.
Not sure where the overlap is between"ssh is enabled" and “one of those OSes”. LXCs maybe?
Samsy@lemmy.ml 1 day ago
KaninchenSpeed@lemmy.blahaj.zone 2 hours ago
checked on my phone, there are a few system users with
!*as their password, from what i can tell!blocks all logins and is not bypassed by this exploit, but their shell is set to/sbin/nologinanyways.lemmyvore@feddit.nl 1 day ago
Most Android apps that make a ssh server use dropbear afaik.
UnpledgedCatnapTipper@piefed.blahaj.zone 1 day ago
Nura (formerly PostmarketOS) is not Android.
lemmyvore@feddit.nl 1 day ago
I expect it’s a common trend though, people generally use Dropbear on embedded devices for the same reasons they prefer Alpine, it’s more compact.
possiblylinux127@lemmy.zip 1 day ago
Even if there is ssh it probably is going to be dropbear and it is unlikely that password based authentication would be enabled
robber@lemmy.ml 1 day ago
I used to run SFTPGO in a container as a NAS type service. Their default image is based on Debian, but they offer Alpine versions. Password authentication is enabled by default.
ikidd@lemmy.dbzer0.com 2 days ago
SSH enabled and the SSH port of the container accessible.
i_am_not_a_robot@discuss.tchncs.de 1 day ago
And there’s an account in the container that has a password set. That’s already a security problem on its own.