I have 4 accounts on my OpenWRT router with * as their password, but I did try with a random password over 256 characters and I couldn't log into them.
You’re absolutely right. I just read the article and as it pointed out OpenWRT I wanted to make sure and tested it anyway. OpenWRT doesn’t even have any SSHD packages available, so that’s good. But as I’ve installed the OpenSSH-sftp-server package quite a few times I probably got confused on top of that as well.
I have 4 accounts on my OpenWRT router with * as their password, but I did try with a random password over 256 characters and I couldn't log into them.
daemon:*:1:1:daemon:/var:/bin/false ftp:*:55:55:ftp:/home/ftp:/bin/false network:*:101:101:network:/var:/bin/false nobody:*:65534:65534:nobody:/var:/bin/falseStill, this is a huge security flaw!
I thought openwrt uses dropbear? Looks like I have password auth turned off anyways so I’m good.
You’re absolutely right. I just read the article and as it pointed out OpenWRT I wanted to make sure and tested it anyway. OpenWRT doesn’t even have any SSHD packages available, so that’s good. But as I’ve installed the OpenSSH-sftp-server package quite a few times I probably got confused on top of that as well.