GNU bug report logs - #45413
Password exposure on SSH login

Previous Next

Full log

View this message in rfc822 format

From: Daniel Martín <mardani29 <at> yahoo.es>
To: "Pedro J. V. Mendes" <pedro.mendes <at> ist.utl.pt>
Cc: 45413 <at> debbugs.gnu.org
Subject: bug#45413: Password exposure on SSH login
Date: Fri, 25 Dec 2020 12:48:28 +0100

[Message part 1 (text/plain, inline)]

"Pedro J. V. Mendes" <pedro.mendes <at> ist.utl.pt> writes:

[Don't forget to CC the bug tracker address so that the entire
conversation gets tracked. Thanks.]

> Hello, and happy Xmas!
>
> I give you snapshot of a minimal session exposing the problem.
>
> When I was typing the password, the characters were showing in
> normal-face, and after pressing Enter they turned to bold-face, like
> the previous "ssh" command.

Do you see at the bottom of the screen a minibuffer prompt that asks for
the password?  If you enter the password in that minibuffer prompt (not
in the shell buffer), it should replace characters with asterisks.  Make
sure you didn't accidentally switch from the minibuffer to the shell
buffer.

[Screenshot showing the problem, from the OP]

[thumbnail.png (image/png, attachment)]

[Message part 3 (text/plain, inline)]

Hm, it looks like a regular "Password:" OpenSSH prompt that should
already be handled correctly, unless I'm missing something.  Does this
happen when you start Emacs as "emacs -Q" too?

>
> After that both the "ssh" command and the password were recorded into
> the history.
>
> I hope this helps.
>

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.