Alpine OpenSSH musl crypt bypass: password login to passwordless accounts

ills3c Intel&Coffee@Ills3C

•updated yesterday•4•0•9

Detects successful SSH password authentication (sshd) for sensitive accounts (such as root or alpine) from public, non-private IP addresses. The rule optionally correlates preceding connection attempts or failures from the same source IP.