CVE-2026-123158 / SSHole defensive checkers
==========================================

LAB-ONLY / DEFENSIVE USE. These scripts read files you export yourself.
They make no network connections and contain no exploit, payload, or login
code. They cannot prove or disprove compromise on their own.

sshole-123158-host-check.py
  Compare an inventory CSV against the upstream OpenSSH 10.6p2 floor
  (2026-11-05 release notes) and the Alpine Linux 2026-11-05 backport table.
  Flags hosts where musl + no PAM + PasswordAuthentication yes + a '*'
  account + a local $5$/$6$ hash line up, which is the condition Alpine
  and the MITRE CVE record describe.

sshole-123158-log-review.py
  Search an auth/syslog export for 'Accepted password for' lines naming
  accounts you listed as passwordless ('*' in the password field). This is
  the hunt Alpine documented. It is a heuristic, not a verdict.

Fixed versions
  Upstream: OpenSSH 10.6p2 and later.
  Alpine packages (advisory 2026-11-05):
    edge 10.6_p2-r0
    3.24 10.3_p1-r2
    3.23 10.2_p1-r1
    3.22 10.0_p1-r11
    3.21 9.9_p2-r1
    3.20 9.7_p1-r6
    3.19 9.6_p1-r3
    3.18 9.3_p2-r4
    3.17 9.1_p1-r7
    3.16 9.0_p1-r6
  After upgrading, restart sshd. Alpine: the package upgrade does not
  replace a running daemon.

If you cannot update yet, Alpine and OpenSSH developer Damien Miller both
point at setting PasswordAuthentication no and restarting sshd. Confirm
key login works first, and keep your current session open.

Do not download unverified public proof-of-concept repos. Help Net Security
quoted Previdian warning that GitHub PoCs for this bug may contain malware.
