10

Ubuntu prints the user password in the text screen that sometimes appear during power off or switching users.

TL;DR

This was a question, but after investigation it turned out to be a bug (IMHO). I've reported it on launchpad. Please check there for any updates.

Original

I have just installed Ubuntu 18.04.1 LTS (bionic) on an old machine (and maybe I only noticed that because it's a slow machine). I used the installation I got from the official Ubuntu website and I started to suspect of that even before I have installed anything else - but I took some time to believe.

I was not able to reproduce this when using just one user, however, when switching users, logging on and off, every now and then (and during power off) the text screen blinks (before the ubuntu logo with the progress dots), and in the bottom of the services statuses, there you have it: the user password!

There's nothing dodgy installed on this machine.

Here's a picture:

enter image description here

In this case the password appeared twice. It's hard to believe I have done anything wrong as I just installed the official release.

I'm no Ubuntu specialist. Is that considered normal?

UPDATE 1:

I found a way to easily test it. After switching users, and running:

sudo cat /dev/tty1

You can see the last passwords - actually, you can see everything which was typed in the login screen (wrong login attempts as well), which is what's also appearing during power off. I've set up a VM with the same Ubuntu version, but so far I was unable to reproduce it. So now I'm suspicious that one of the apps I've installed is actually the evildoer. I'll continue tests (basically reproducing all the steps in the VM) and post here.

UPDATE 2:

Installed all the apps, all updates, and performed all the steps I remember I have executed (switching language, configuring input, etc). I just can't reproduce it - yet the faulty machine consistently prints all keys of the login window (and only the from the login window) to /dev/tty1.

Maybe the issue lays in some driver that this old machine requires and the VM does not.

Now all I want to do is to explode this machine, but I'll make a bug report first. Then I'll reconfigure this machine from scratch and if it still has the problem, I'll update this.

UPDATE 3:

So this is the bug on launchpad.

UPDATE 4:

New install on a different machine. 18.04 from canonical, no app installed, all the updates installed - no additional app whatsoever and I was able to reproduce it. However, the symptom does not show on 4.15.0-29-generic recovery mode.

Running:

sudo lsof /dev/tty1

prints two processes, systemd-l and gdm-wayla.

Yeah, now I'm done with the subject. It is part of Ubuntu and not an external app. I'll pretend that it doesn't exist and consider that I've made my part on reporting the bug.

16
  • 2
    I highly think that is not possible as passwords in Linux... are not stored in plain-text.
    – NerdOfCode
    Commented Feb 1, 2019 at 19:12
  • That is the boot screen output, and if you modify the boot command line, removing "quiet" and "splash" you will be able to see the lines all the time. I have only a single user on my system, and so will not be able to verify this password display issue. Commented Feb 1, 2019 at 19:59
  • @NerdOfCode I don't think it's stored, my theory is someone forgot a print to console while debugging ... And I would think the same as you if it wasn't me, or if I didn't have installed it from scratch using the oficial release...
    – Feu
    Commented Feb 1, 2019 at 20:29
  • @CharlesGreen Are you using 18.04.1 ? If so, the other users I was using were not even admins, just switching to them and switching back would be enough to test. If you could test it (and then delete the users) I would appreciate!
    – Feu
    Commented Feb 1, 2019 at 20:31
  • 6
    I think you should write a bug report at Launchpad about this problem. Get a user ID at launchpad.net and create a bug report: Run ubuntu-bug ubuntu and follow the instructions. (Until we know better, blame ubuntu). I think you will get help to give more details about the problem by people who know more about bug reports at Launchpad.
    – sudodus
    Commented Feb 2, 2019 at 14:09

1 Answer 1

1

New here but found your problem very interesting. I believe, if you are in fact telling the truth, then some program you have installed or opened just one time has installed something of the following. To record when you enter your password.

https://unix.stackexchange.com/questions/138342/how-to-read-write-to-tty-device

Not sure if you can search the contents of each file but something like the following is what I would look for. And if you're up for a challenge, try to create one yourself, to gather that info, and that might help you find the culprit.

#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>    
int main() {
    char byte;
    int fd = open("/dev/pts/3", O_RDWR);
    write(fd, "X", 1);
    ssize_t size = read(fd, &byte, 1);
    printf("Read byte %c\n", byte);
    return 0;
}

Good Luck!

Denis

1
  • Thanks for the insight, your comment made me have an idea and then I learned about the lsof command, which shows which processes are using a given resource (such as /dev/tty1/. Please read my update 4, I'm aware that not many people will believe me, but I'm convinced it's not an external app.
    – Feu
    Commented Feb 10, 2019 at 22:31

Not the answer you're looking for? Browse other questions tagged .