Cyber ·
Password authentication timing in OpenSSH with musl libc and locked accounts
A translated reply on the oss-sec list reports timing tests of OpenSSH password authentication with locked accounts, comparing glibc with libxcrypt and musl. The received text is truncated and gives no final conclusions.
This item is a reply on the oss-sec mailing list, machine translated, about password authentication tests in OpenSSH with locked accounts. The author used OpenSSH 10.6p2 built without PAM and a shadow file with no valid passwords, with accounts marked as locked using formats such as asterisk, exclamation mark, double exclamation mark, LK and a locked yescrypt hash. Password authentication remained enabled. The author ran 60 interleaved samples per account, measuring only the time of the authentication request, with glibc and libxcrypt and with musl. Scripts and raw data are available on request. The received text ends abruptly, so the full results do not appear in the item.
The relevance lies in the central question: whether the timing difference occurs even when there is no reusable salt. Differences like this may interest administrators and security researchers. Rota Nacional does not fix OpenSSH or C libraries and does not offer authentication analysis capability. To study this material with AI, do not paste shadow file output, hashes, usernames, server addresses or logs; use generic descriptions. Before acting, consult the original source on the oss-sec list and your distribution vendor's release notes.
Original source: Re: “sshole”: desvio da autenticação por senha no OpenSSH com musl libc