Arch Linux

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!
Tasklist

FS#41978 - [util-linux] Login may leak password

Attached to Project: Arch Linux
Opened by Philipp (hollunder) - Monday, 15 September 2014, 12:58 GMT
Last edited by Dave Reisner (falconindy) - Tuesday, 16 September 2014, 11:56 GMT
Task Type Bug Report
Category Packages: Extra
Status Closed
Assigned To Dave Reisner (falconindy)
Tom Gundersen (tomegun)
Architecture All
Severity Low
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description:
On login the password can be leaked/echoed at least to the screen. This might not seem like a major issue as you can just wait a bit before typing the password. But what about automated logins? Are they also affected? It is clear that login ceases its control over the input between the username and password promt, which seems very wrong to me.


Additional info:
* package version(s)
Current and past versions going back a number of months.

* config and/or log files etc.
No special configuration.

Steps to reproduce:
Set the system up without any login manager. Type the user name, hit enter and immediately type the password. The time interval seems to be somewhat random but if you're quick enough your whole password or part of it gets echoed to the screen.
This task depends upon

Closed by  Dave Reisner (falconindy)
Tuesday, 16 September 2014, 11:56 GMT
Reason for closing:  Not a bug
Additional comments about closing:  Nothing for Arch to do, and login can't buffer input for a prompt that it isn't providing itself.
Comment by Dave Reisner (falconindy) - Monday, 15 September 2014, 13:49 GMT
I think you misunderstand how logging in works at a TTY. Just to make sure we're on the same page:

1) agetty(8) prompts you for your username.
2) You enter your username, press enter.
3) agetty spawns login(1) with the provided username as an argument.
4) login(1) does some validation, and then asks PAM to start a new session. If /etc/pam.d/login contains pam_unix.so, you might be prompted for a password. You might have some other method of authentication like a Yubikey or secure card, or a biometric device, or an OTP token, or... the list goes on.

There's a gap of time in here between you hitting enter at the end of step 2, and a potential step 4 where you're prompted for a password via pam_unix.so. login itself can't buffer input because it isn't responsible for getting the password. If you blank all input but don't necessarily accept it, how does the user know (other than the presence of the password prompt) what they've already entered?

I tend to think this is just PEBKAC, but I'm quite sure that there's nothing for Arch to do here. Feel free to contact upstream util-linux (probably util-linux@vger.kernel.org) if you think that things can be done better.
Comment by Philipp (hollunder) - Tuesday, 16 September 2014, 09:31 GMT
You are right Dave, I was not aware how login works exactly so it is PEBKAC in some sense. The problmatic period seems to be when agetty spawns login. For some reason this can take rather long, sometimes seconds, long enough for me to type my entire password. I skimmed over the man pages of agetty and login and now wonder whether agetty is actually needed. As far as I can see login could ask for the user name instead and I assume it would buffer the input.

Loading...