Bug 1318721 - nmcli --ask c up vpn: displays passwd in clear text on the screen
Summary: nmcli --ask c up vpn: displays passwd in clear text on the screen
Keywords:
Status: CLOSED NEXTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: NetworkManager
Version: 23
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Lubomir Rintel
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-03-17 15:18 UTC by Marcelo Ricardo Leitner
Modified: 2016-03-18 08:25 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-03-18 08:25:04 UTC
Type: Bug

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Private Priority Status Summary Last Updated
GNOME Bugzilla 759116 0 None None None 2016-03-18 08:25:04 UTC

Description Marcelo Ricardo Leitner 2016-03-17 15:18:03 UTC 
Description of problem:
If you use nmcli to bring up a VPN that requires a password, nmcli requires you to use --ask option in order to ask it on the console.
But then when you type it, it will show what you typed in clear text on the screen, possibly revealing your entire password or PIN in case of two-factor authentication.

It would be best if it masked the passwd somehow, or simply show nothing like login does.

I'm using vpnc. I believe this is broader than vpnc plugin, but please move it to that component if it's appropriate.

Version-Release number of selected component (if applicable):
NetworkManager-1.0.10-3.fc23.x86_64
Comment 1 Beniamino Galvani 2016-03-18 08:25:04 UTC 
Hi,

thanks for reporting this. The issue was fixed in

https://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=c52b2044cd25859e2f4c4d3a816937ed040fdd8c

which will be included in NM 1.2 / F24.
Note You need to log in before you can comment on or make changes to this bug.