OpenBSD OpenSSH sshd password authentication bypass on musl libc without PAM

#!/bin/bash
# CVE-2026-123158 check: OpenSSH <10.6p2 + musl + UsePAM no + PasswordAuthentication yes + no-password account with shell
set -u

SSHD_BIN="$(command -v sshd || true)"
if [ -z "$SSHD_BIN" ] || [ ! -x "$SSHD_BIN" ]; then
  echo "UNKNOWN: sshd not found"
  exit 3
fi

# 1. Check libc
if ! ldd "$SSHD_BIN" 2>/dev/null | grep -q musl; then
  echo "PATCHED: not musl-linked (glibc or non-musl build)"
  exit 0
fi

# 2. Check version < 10.6.2 (OpenSSH_10.6p2)
full_ver="$($SSHD_BIN -V 2>&1 | head -1 | sed -n 's/OpenSSH_\([0-9][^ ,]*\).*/\1/p')"
if [ -z "$full_ver" ]; then
  echo "UNKNOWN: cannot parse sshd version"
  exit 3
fi

if awk -v v="$full_ver" 'BEGIN { split(v,a,"[p.]"); split("10.6.2",b,"[p.]"); for(i=1;i<=3;i++){ if ((a[i]+0) < (b[i]+0)) exit 1; if ((a[i]+0) > (b[i]+0)) exit 0; } exit 0 }'; then
  echo "PATCHED: sshd version $full_ver is >= 10.6.2"
  exit 0
fi

# 3. Check sshd effective configuration
if ! conf="$($SSHD_BIN -T 2>/dev/null)"; then
  echo "UNKNOWN: cannot read sshd effective config (run as root)"
  exit 3
fi

usepam="$(echo "$conf" | awk '$1=="usepam"{print $2}')"
passauth="$(echo "$conf" | awk '$1=="passwordauthentication"{print $2}')"

if [ "$usepam" != "no" ]; then
  echo "PATCHED: UsePAM is '$usepam' (not no)"
  exit 0
fi
if [ "$passauth" != "yes" ]; then
  echo "PATCHED: PasswordAuthentication is '$passauth' (not yes)"
  exit 0
fi

# 4. Look for a locked/no-password account with a valid shell
vuln_account=""
while IFS=: read -r user pass uid gid gecos home shell; do
  if [ "$pass" = "*" ] && [ -n "$shell" ] && ! echo "$shell" | grep -Eq '/(nologin|false)$'; then
    vuln_account="$user"
    break
  fi
done < /etc/shadow

if [ -z "$vuln_account" ]; then
  echo "PATCHED: no locked/no-password account with valid shell found"
  exit 0
fi

echo "VULNERABLE: sshd $full_ver on musl, UsePAM no, PasswordAuthentication yes, account '$vuln_account' has * password with shell $shell"
exit 1