Skip to content

Security issue: using /bin/echo to pass password can be seen using ps tool #3

@xvan-ham

Description

@xvan-ham

Command echo "__SSH_USERNAME__:__SSH_PASSWORD__" | chpasswd used for nginx will work but is highly insecure, more so due to non-bash shell lacking echo as a built-in command. It will execute /bin/echo and so the password will show up in the process table and can be seen with tools like ps.

The passwd command was intentionally built to require input from the keyboard, using the --stdin option to pipe in the password (or the chpasswd command when this option is not available) goes against unix security policies. It is used here for academic purposes but this should be documented and perhaps changed.

Slightly less insecure example:
passwd --stdin < "passwordfile" # With a password file that was created with a secure umask(1), a little bit secure.

See: mywiki.wooledge and stackoverflow

Metadata

Metadata

Assignees

Labels

No labels
No labels

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions