SSH vulnerability for musl-based systems without PAM.

We’ve become aware of a vulnerability that affects OpenSSH. This has been named "Sshhole.com" and can allow logging in with any password over 256 characters in some situations.

Affected systems: This appears to impact a very small subset of Linux systems, specifically those using musl without PAM such as Alpine Linux. Debian, Ubuntu and RHEL based systems such as AlmaLinux and Rocky are by default unaffected and no further action is required.

Non-affected systems: It does NOT affect our shared hosting customers, or our standard installation for virtual or dedicated servers for either our managed or standard customers. If you have installed or made any adjustment to your system to use musl without PAM we strongly recommend you follow the mitigation as provided on sshhole.com.

Some less common distributions, heavily customised systems or those with docker images might be using musl without PAM and affected by this vulnerability. Colocation customers and those who have deployed vulnerable images via docker should check the distributions/images and confirm they are not vulnerable.