Re: [[email protected]: Bug#198843: very chatty with password information]

Guido Trotter wrote:

>Hi,
>
>I received this request from a Debian user not to disclose the user
>password, when displaying the user information, since the X console may be
>logged somewhere.
>I agree with him, but I'd rather implement it simply displaying some fake
>token instead of the actual password, and not actually commenting out the
>debugging information. Perhaps DA could write something like
>
>password: ******** (actual password not displayed)
>
>If you concur with my solution I can write a patch to address this. If you
>have a better idea please tell me. :)
>
As Abagnale said in Catch me if you can, I concur.  But, isn't the 
password already obscured with asterisks?

>
>Bye, and Thanks,
>
>Guido
>
>----- Forwarded message from Jamie Wilkinson <[email protected]> -----
>
>Subject: Bug#198843: very chatty with password information
>Resent-Message-ID: <[email protected]>
>X-Debian-PR-Message: report 198843
>X-Debian-PR-Package: directory-administrator
>X-Debian-PR-Keywords: security
>Date: Thu, 26 Jun 2003 13:29:00 +1000
>From: Jamie Wilkinson <[email protected]>
>To: [email protected]
>
>Package: directory-administrator
>Version: 1.5.1-4
>Tags: security
>Severity: normal
>
>d-a protects passwords with the ol' **** prompt in the interface, but happily
>spews out the password entered in various locations to the console.  When
>running from an X menu, who knows where console output may be logged?
>
>For example:
>
>get_group_cn_list: filtering entries for groups' CNs
>Keypress on modify user dialog xxx (x) state 16
>...
>...
>set password called with password: xxxxxx
>set password set attribute: xxxxxx
>
>...
>
>Entry was modified.  Changes follow:
>LDAP_MOD_DELETE objectclass
>        account
>LDAP_MOD_REPLACE userPassword
>         xxxxxx
>LDAP_MODE_REPLACE authPassword
>         xxxxxxx
>
>...
>
>Called process preferences dialog
>password type md5sum(null)set password called with password
>set password set attribute: {crypt}$1$...
>
>and so on.  (actual password components replaced with x)
>
>It would be really nice if d-a didn't include password information as part of
>the debugging output at all -- I suggest whereever the code is printing the
>password, that code just be commented out (unless there's a better way to
>disable this "feature").
>
>Jamie
>
>----- End forwarded message -----
>
>  
>




-------------------------------------------------------
This SF.Net email sponsored by: Parasoft
Error proof Web apps, automate testing & more.
Download & eval WebKing and get a free book.
www.parasoft.com/bulletproofapps1