upgrade openssh-server package from v10.3_p1-r1 to v10.3_p1-r2 (#138)
Relevant changes (https://git.alpinelinux.org/aports/log/main/openssh?h=3.24-stable):
- fix password authentication bypass (CVE-2026-123158), backported from upstream commit 90f9c2f7330b3b417b7d6202cd393ef3c226722c (https://git.alpinelinux.org/aports/commit/?h=3.24-stable&id=384e25e6bd1f2e7b30095900e48b570d46953510, https://git.alpinelinux.org/aports/commit/?h=3.24-stable&id=1d539b51c094bb2ea3ddaaa6a4b49d7ab64d22a0)
The patch only changes how sshd verifies passwords against the stored password hash (`sys_auth_passwd()` in `auth-passwd.c`, `openbsd-compat/port-uw.c`, `openbsd-compat/xcrypt.c`); among other changes, it rejects stored hashes shorter than 4 characters. sshd only reaches this code through password-based authentication, and the image's `sshd_config` disables all of those paths:
- `PasswordAuthentication no` disables the `password` method. It also disables the empty-password check of the `none` method, which additionally requires `PermitEmptyPasswords yes` (default: no).
- `ChallengeResponseAuthentication no` is a deprecated alias for `KbdInteractiveAuthentication no` and disables `keyboard-interactive`.
- `UsePAM` keeps its default `no`, and Alpine's `openssh-server` package is built without PAM support (PAM is provided by the separate `openssh-server-pam` package), so PAM cannot re-enable password checks.
- `PubkeyAuthentication yes` is the only enabled method, and every key in `authorized_keys` is restricted to `borg serve` via `command=` and `restrict` (`entrypoint.sh`).
So containers using the image's `sshd_config` are not vulnerable. Deployments that bind-mount their own `sshd_config` with `PasswordAuthentication yes` or `KbdInteractiveAuthentication yes` may be vulnerable, depending on the `borg` user's password entry; this upgrade fixes them as well.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
