n0hup@relay:~$ ./sshole-check --passive
SSHole Check
A passive local assessment for SSHole (CVE-2026-123158), the OpenSSH password-authentication bypass affecting certain musl-based, non-PAM deployments. It collects a small set of local facts without attempting authentication, and tells you where to look first.
[[ RELEASE v0.1.0 ]] [[ SOURCE ON CODEBERG ]] [[ READ THE ADVISORY ]]
What it reads
- System: distribution identifiers and Alpine package metadata.
- Runtime: presence of a conventional musl loader and SSH binary.
- Configuration: counts of selected directives in the main SSH configuration; an existing
sshd -Treport can be supplied and is labelled as supplied and unverified. - Accounts (optional): shadow inspection reports aggregate counts only. No username, password field or hash is printed.
Results
| Result | Meaning |
|---|---|
REVIEW_REQUIRED | Evidence remains incomplete. |
PRIORITY_REVIEW | A musl loader and the local account pattern coexist; investigate promptly. |
Neither result asserts exploitability, and neither is a safety certificate.
What it does not do
It does not run sshd, query NSS, call a package manager, create temporary files or contact a host. It counts configuration directives rather than reimplementing OpenSSH’s parser.
Release scope
Source, documentation and synthetic offline tests. Local validation covers /bin/sh and dash on macOS; it does not constitute Alpine, BusyBox or production integration testing. AI-assisted preparation is disclosed; independent security review remains pending. MIT licence.
Need a fleet-wide review?
RELAY can inventory reachable SSH services, images and appliances, establish vendor patch provenance and verify the running daemons as part of a Unix/Linux Hardening Review.