Cleartext password shows up in Metalog

by **MarlonNelson** on Sun Mar 09, 2008 9:42 am

I activated Metalog. Recently, I've noticed my password showing up in the log.

everything/log-2008-03-08-01:00:01:Mar 7 16:51:37 [sudo] pcor : TTY=tty1 ; PWD=/ ; USER=root ; COMMAND=/usr/bin/PCoR/cachefs/authentify_changepwd.sh XXXXXXXX

This seems like a bad idea.

Any chance this could be fixed?

by **maniac** on Sun Mar 09, 2008 5:47 pm

MarlonNelson wrote:I activated Metalog. Recently, I've noticed my password showing up in the log.

everything/log-2008-03-08-01:00:01:Mar 7 16:51:37 [sudo] pcor : TTY=tty1 ; PWD=/ ; USER=root ; COMMAND=/usr/bin/PCoR/cachefs/authentify_changepwd.sh XXXXXXXX

This seems like a bad idea.

Any chance this could be fixed?

Hmm. After looking at that script (and some related ones), the options appear somewhat limited.

Suppressing the log of sudo commands is one solution but appears heavy handed.
chpasswd does allow you to pass it encrypted passwords, but smbpasswd doesn't.

Side note - You may want to search other files for plain text passwords. CUPS configuration files (to print on remote servers) saves the PW in plain text. I found an evolution file w/ a plain text password as well.

A full fix may require an encrypted hard disk or file system (since the way to enable developer edition is published in the public).

by **MarlonNelson** on Sun Mar 09, 2008 6:46 pm

I was thinking of trying the following changes, but I'm reluctant to tweak this part of the zonbu infrastructure:

# diff /usr/bin/PCoR/cachefs/authentify_changepwd.sh authentify_changepwd.sh

Code: Select all: 2,4c2,4 < < echo -e "${1}\n${1}" | smbpasswd -a pcor -s < echo pcor:${1} | chpasswd -m --- > read pwd > echo -e "${pwd}\n${pwd}" | smbpasswd -a pcor -s > echo pcor:${pwd} | chpasswd -m

# diff /usr/bin/PCoR/cachefs/authentify.sh authentify.sh

Code: Select all: 54c54,55 < /usr/bin/sudo /usr/bin/PCoR/cachefs/authentify_changepwd.sh "${1}" --- > PWD="${1}" > /usr/bin/sudo /usr/bin/PCoR/cachefs/authentify_changepwd.sh <<<$PWD

# diff /usr/bin/PCoR/cachefs/changepwd.py changepwd.py

Code: Select all: 69c69 < p = subprocess.Popen([SUDO, PCOR_CHPASSWD, self.new], --- > p = subprocess.Popen([SUDO, PCOR_CHPASSWD], 71c71 < p.communicate() --- > p.communicate(self.new)

by **plasmaroo** on Mon Mar 10, 2008 10:45 am

If you could please file a bug for this that would be appreciated.

Thanks!

by **MarlonNelson** on Mon Mar 10, 2008 1:02 pm

Done! http://bugzilla.zonbu.com/show_bug.cgi?id=1321

Cleartext password shows up in Metalog

Cleartext password shows up in Metalog

Re: Cleartext password shows up in Metalog

Re: Cleartext password shows up in Metalog

Re: Cleartext password shows up in Metalog

Re: Cleartext password shows up in Metalog

Who is online