Bug 1318721

Summary: nmcli --ask c up vpn: displays passwd in clear text on the screen
Product: [Fedora] Fedora Reporter: Marcelo Ricardo Leitner <mleitner>
Component: NetworkManagerAssignee: Lubomir Rintel <lkundrak>
Status: CLOSED NEXTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: 23CC: bgalvani, dcbw, lkundrak, psimerda
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-03-18 08:25:04 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Marcelo Ricardo Leitner 2016-03-17 15:18:03 UTC 
Description of problem:
If you use nmcli to bring up a VPN that requires a password, nmcli requires you to use --ask option in order to ask it on the console.
But then when you type it, it will show what you typed in clear text on the screen, possibly revealing your entire password or PIN in case of two-factor authentication.

It would be best if it masked the passwd somehow, or simply show nothing like login does.

I'm using vpnc. I believe this is broader than vpnc plugin, but please move it to that component if it's appropriate.

Version-Release number of selected component (if applicable):
NetworkManager-1.0.10-3.fc23.x86_64
Comment 1 Beniamino Galvani 2016-03-18 08:25:04 UTC 
Hi,

thanks for reporting this. The issue was fixed in

https://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=c52b2044cd25859e2f4c4d3a816937ed040fdd8c

which will be included in NM 1.2 / F24.