[devGregA]

Adds the sshole detector for *sshole, the OpenSSH password authentication bypass on musl libc, fixed in OpenSSH 10.6p2 (commit 4353fdc43) and in Alpine's openssh packages of 2026-11-05.

On musl, sshd from 7.3p1 to 10.6p1 compares an account's password field of * with the * that crypt returns when it fails. The donor salt sshd borrows decides which passwords make crypt fail: sha256 or sha512 above 256 bytes, bcrypt or a bad rounds= value for every password.

What it checks

• fs and image: each sshd's C library, release and apk package (Alpine 3.16 to 3.24 and edge backports), PAM linkage and UsePAM, sshd_config with Include and Match (PasswordAuthentication, AuthenticationMethods, PermitRootLogin, Allow/Deny lists, ChrootDirectory), and the accounts read the way musl reads them. exposed (critical, or high when a Match decides) names the accounts; sshd covers unfixed builds that today's accounts or settings do not expose, fixed builds and PAM-checked ones.
• host: banner and offered login methods only. No password is ever sent. engine.ErrNotApplicable lets a host scan skip a detector whose service is not on that address.
• repo and fix: apk add of an OpenSSH server on Alpine gets the fixed release floor for its branch (read from the base image through the guarded transport when the tag does not name it). Password fields set to * (usermod, chpasswd -e, sed on /etc/shadow, Ansible and cloud-init) become *NP*. Every edit is rescanned in memory first.

Other changes

• netguard moves from detectors/php2shell/internal to internal, unchanged (noted in SNAPSHOT).
• image.OpenRegistry takes a transport and refuses local archives.
• CI fuzzes the new parsers.

Testing

• go vet ./..., go test -race ./..., fuzzing of Inspect, accounts, config and the source-tree scanner.
• parity/sshole.py: 8/8 fixture images (unfixed, fixed, password logins off, UsePAM on, root with PermitRootLogin, Match on address, Alpine 3.24, Debian).
• Real images: linuxserver/openssh-server and atmoz/sftp report fixed; gitea, forgejo 11, jenkins/ssh-agent:alpine and panubo/sshd report unfixed but not exposed as shipped.
• fix on a sample tree, then a rebuild of the edited Dockerfile, gives an image the detector reports fixed.

The Sensei port is in DefectDojo-Inc/defectdojo-scan-and-fix (branch devgrega/sshole-sensei).

Added after review: coverage gaps closed

• Startup: the image's command (sshd -o, -f, through tini, sh -c and wrappers) and its startup scripts (the command's script, s6-overlay, cont-init.d, entrypoint.d, /etc/s6). A script that turns password logins on, sets a * field or sets passwords with chpasswd makes an unfixed server exposed (high). UsePAM yes at start counts only for PAM builds; disagreeing or test-mode (sshd -t) command lines are not applied. The engine passes the image's Entrypoint and Cmd (TargetContext.Command).
• OpenWrt: opkg database, with the 23.05, 24.10 and 25.12 backports of 2026-11-05.
• Source trees: ARG/ENV package lists (fixed where the value is written; unset variables are notes), Ansible apk tasks (fix: state: latest), Buildroot, OpenWrt and Yocto musl builds (manual steps with the fixed release or the patch), and alpine:3.N end-of-life bases moved to 3.16 as a labelled upgrade.
• Parity: 10/10 fixture images, including an entrypoint that turns password logins on and sshd -o in the image command.

Added in the second gap round

• scan repo pulls the images a tree references (guarded transport, at most 20) and judges them with the command a Compose service (entrypoint, command) or Kubernetes container (command, args) sets.
• fix: an Alpine-suffixed end-of-life base (python:3.9-alpine3.14) moves to the same tag on the nearest fixed Alpine release once that image is confirmed to be that release.
• fix: Buildroot and Yocto builds get upstream commit 4353fdc43 as a patch scoped to OpenSSH 8.9p1 to 10.6p1 (Buildroot versioned patch directories; a version-specific Yocto bbappend). The patch applies cleanly to every release in that range; patched 8.9p1, 9.9p2 and 10.6p1 build on musl. Fixes can add files.
• Not done: recognising the fix inside a stripped binary. It leaves no string or symbol, and a code pattern that could clear a vulnerable build is worse than the current false positive on hand-patched builds.

🤖 Generated with Claude Code