Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

When you connect to a new SSID network via the network manager applet, the key for that network is stored in gnome-keyring under the "login" keychain.

But when you then change (edit) that network to be "Available to all users", the password moves somewhere else. I'd like to know where, because if it's a PEAP network, that's effectively your Active Directory password.

alt text

Background I tick most WIFI networks as "available to all users" not to actually make them available (it's a single-user laptop anyway), but rather to prevent anyone from seeing my password for that network in clear text simply by right clicking on the network, clicking on security tab and ticking "show password". This is because when you make a network "available to all users", the act of editing that network triggers a system prompt via policykit.

This is the same reason I instantly un-install Seahorse after a fresh install. Crazy security risk allowing this.

share|improve this question
    
Crazy security risk? Only if you leave your machine unattended and unlocked with other people around. Storing passwords in an encrypted key chain is usually considered beneficial to security. –  David Foerster Oct 2 '13 at 23:25
    
David, you clearly haven't worked in a corporate environment much if you think that everybody locks their laptops, without fail, every time they step away from their desk. It's one thing to say "yes you should" and the opposite is a thing called "reality" which means that sometimes, just sometimes, it happens. If it's a properly installed Windows, not much harm can come to it. It's a properly installed Ubuntu, the same... unless you have Seahorse installed. Then you've just given away your password, in clear text, to anyone who cares to look. –  Scaine Oct 3 '13 at 19:47
    
Yes, I know about the fallacies of convenience vs. security. But diving into that would probably be too off topic. –  David Foerster Oct 4 '13 at 9:59
add comment

3 Answers 3

up vote 10 down vote accepted

I don't have an wifi to check it right now, but according to http://live.gnome.org/NetworkManager/SystemSettings , system connections should be stored at /etc/NetworkManager/system-connections/ .

share|improve this answer
    
And now confirmed. The system-connections directory holds all your WIFI networks that are ticked "Available to All Users", with the PSK in cleartext. However, it's readable only by root, which is good enough for my use case. Magic - thanks! –  Scaine Jan 23 '11 at 14:08
add comment

Assuming that we all know how wireless authentication happens between a client and server/router, your machine will try to 'remember' the Access point name to help us not keep putting in the same key over and over again.

All networks 'remembered' keys are unencrypted and stored in:

/etc/NetworkManager/system-connections

if we cat out one of the files you will see: (this is my box)

[connection]

id=Auto FLPHF
uuid=495d8230-53bd-4df5-812a-374526fdb031
type=802-11-wireless
[802-11-wireless]
ssid=FLPHF
mode=infrastructure
mac-address=00:C0:CA:40:AE:5F
security=802-11-wireless-security
[802-11-wireless-security]
key-mgmt=wpa-psk
auth-alg=open
psk=[TOOK OUT MY KEY]< you get the idea. 
[ipv4]
method=auto
[ipv6]
method=auto
share|improve this answer
add comment

It is stored in /etc/network/interfaces and is not encrypted!

share|improve this answer
    
It isn't stored in /etc/network/interfaces! –  Eric Carvalho Oct 2 '13 at 23:02
    
It used to be, just many years ago. –  Oli Nov 4 '13 at 11:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.