Cyber ·
Oss-sec discussion on hiding account existence on OpenSSH servers with musl libc
Matt Johnston, replying on the oss-sec list in a message dated November 6, treats hiding whether an SSH account exists as a privacy feature and questions its value as a security measure.
This item is a machine translation of a message on the oss-sec mailing list, in the thread titled “sshole”, about a password authentication bypass in OpenSSH on musl libc. The available text contains only Matt Johnston's reply, dated November 6 and published in the feed on November 7, 2026. He argues that avoiding exposure of whether an account exists is more a privacy feature than a security one. According to him, scanning IPv4 SSH servers for a specific username can reveal which host accepts it, which may point to someone's IP address, although this may already be exposed in other ways. As a purely security measure, he agrees the added complexity is not worth it. The text does not include the full technical description of the bypass, the affected versions or the fixes, so those points cannot be confirmed here. To verify, consult the original list archive referenced in the feed item, read the later messages in the thread and check the OpenSSH project advisories.
Original source: Re: “sshole”: desvio da autenticação por senha no OpenSSH com musl libc