Debian Bug report logs - #357118
debconf: exposes passwords in debug messages

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Colin Watson <cjwatson@debian.org>

To: submit@bugs.debian.org

Subject: debconf: exposes passwords in debug messages

Date: Wed, 15 Mar 2006 18:52:16 +0000

[Message part 1 (text/plain, inline)]

Package: debconf
Version: 1.4.72
Severity: normal
Tags: patch

debconf exposes the answers to password questions in its debug
information. This is rather annoying when writing installer-related
applications based on debconf, as it means that you can't safely ask for
debugging logs without having to get people to strip passwords out of
them first; today I had a normally extremely security-conscious
developer send me his password for his home systems by mistake. I
suspect that quite a lot of passwords are lying around in attachments to
bugs in various bug tracking systems, unnoticed by the senders.

The attached patch attempts to hide passwords even when the 'developer'
and/or 'db' debug modes are set. It's pretty ugly in places, though, so
I haven't just checked it in. What do you think?

Cheers,

-- 
Colin Watson                                       [cjwatson@debian.org]

[debug-hide-passwords.diff (text/plain, attachment)]

Message #10 received at 357118@bugs.debian.org (full text, mbox, reply):

From: Joey Hess <joeyh@debian.org>

To: Colin Watson <cjwatson@debian.org>, 357118@bugs.debian.org

Subject: Re: Bug#357118: debconf: exposes passwords in debug messages

Date: Tue, 18 Apr 2006 17:24:30 -0400

[Message part 1 (text/plain, inline)]

Colin Watson wrote:
> -	debug developer => "<-- $_";
> +	# Nasty hack to stop SET passwords showing up in debug messages.
> +	if (/^set /i) {

I'm afraid I lost it here. Too ugly to use IMHO.

I think it might be best to keep this analagous with strace or gdb logs, and
just require common-sense stripping of sensative info before publishing.

-- 
see shy jo

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.