All my servers go through Ansible, so here’s how I’d check a whole inventory for the *sshole conditions in one pass.
1. Find musl hosts and their sshd settings
ansible all -b -m shell -a 'ldd --version 2>&1 | head -1; ssh -V 2>&1; sshd -T 2>/dev/null | grep -Ei "^(passwordauthentication|usepam) "'Look for “musl” on the first line, passwordauthentication yes, and usepam no. glibc hosts aren’t affected.
2. List accounts locked with an asterisk
ansible all -b -m shell -a "awk -F: '\$2==\"*\"{print \$1}' /etc/shadow"3. Fix it the Ansible way
Upgrade OpenSSH to 10.6p2 or later (apk upgrade openssh on Alpine), and turn off password auth while you’re at it:
- name: Disable SSH password auth
ansible.builtin.lineinfile:
path: /etc/ssh/sshd_config
regexp: '^#?PasswordAuthentication'
line: 'PasswordAuthentication no'
validate: 'sshd -t -f %s'
notify: restart sshdMake sure key login works first so you don’t lock yourself out, and check for Include drop-ins that override it (sshd -T shows the final value).
4. Look for signs of use
Search your auth logs for Accepted password on any account from step 2. A password login to a * account is a red flag.
Review before you install: read the release notes yourself, back up your config, and try new versions somewhere you can afford to break first.
God Bless, and May the Source Be with You!
