[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Cleartext password in login-failure message
From: |
Ross Patterson |
Subject: |
Cleartext password in login-failure message |
Date: |
Tue, 11 Nov 2003 10:46:02 -0500 |
User-agent: |
KMail/1.4.3 |
When a user attempts to log in to a remote repository via pserver with the
wrong password, CVS writes a message to the LOG_AUTHPRIV syslog() facility
containing the incorrect password. As a bonus, if you're running release
1.11.6 or later, I believe it also includes the correct password - we're not
there yet, but that's the way the src/server.c looks to me.
I know a proper syslogd setup will send LOG_AUTHPRIV messages to someplace
secure (e.g. /var/log/secure on Red Hat Linux), but it still seems wrong to
include either password in the message. Doubly wrong if you're using system
passwords to secure CVS.
Can we please consider suppressing the passwords, at least optionally?
--
Ross A. Patterson
Chief Technology Officer
CatchFIRE Systems, Inc.
5885 Trinity Parkway, Suite 220
Centreville, VA 20120
(703) 563-4164
- Cleartext password in login-failure message,
Ross Patterson <=