9

When you connect to a new SSID network via the network manager applet, the key for that network is stored in gnome-keyring under the "login" keychain.

But when you then change (edit) that network to be "Available to all users", the password moves somewhere else. I'd like to know where, because if it's a PEAP network, that's effectively your Active Directory password.

alt text

Background I tick most WIFI networks as "available to all users" not to actually make them available (it's a single-user laptop anyway), but rather to prevent anyone from seeing my password for that network in clear text simply by right clicking on the network, clicking on security tab and ticking "show password". This is because when you make a network "available to all users", the act of editing that network triggers a system prompt via policykit.

This is the same reason I instantly un-install Seahorse after a fresh install. Crazy security risk allowing this.

3
  • Crazy security risk? Only if you leave your machine unattended and unlocked with other people around. Storing passwords in an encrypted key chain is usually considered beneficial to security. Oct 2, 2013 at 23:25
  • David, you clearly haven't worked in a corporate environment much if you think that everybody locks their laptops, without fail, every time they step away from their desk. It's one thing to say "yes you should" and the opposite is a thing called "reality" which means that sometimes, just sometimes, it happens. If it's a properly installed Windows, not much harm can come to it. It's a properly installed Ubuntu, the same... unless you have Seahorse installed. Then you've just given away your password, in clear text, to anyone who cares to look.
    – Scaine
    Oct 3, 2013 at 19:47
  • Yes, I know about the fallacies of convenience vs. security. But diving into that would probably be too off topic. Oct 4, 2013 at 9:59

3 Answers 3

12

I don't have an wifi to check it right now, but according to http://live.gnome.org/NetworkManager/SystemSettings , system connections should be stored at /etc/NetworkManager/system-connections/ .

1
  • And now confirmed. The system-connections directory holds all your WIFI networks that are ticked "Available to All Users", with the PSK in cleartext. However, it's readable only by root, which is good enough for my use case. Magic - thanks!
    – Scaine
    Jan 23, 2011 at 14:08
4

Assuming that we all know how wireless authentication happens between a client and server/router, your machine will try to 'remember' the Access point name to help us not keep putting in the same key over and over again.

All networks 'remembered' keys are unencrypted and stored in:

/etc/NetworkManager/system-connections

if we cat out one of the files you will see: (this is my box)

[connection]

id=Auto FLPHF
uuid=495d8230-53bd-4df5-812a-374526fdb031
type=802-11-wireless
[802-11-wireless]
ssid=FLPHF
mode=infrastructure
mac-address=00:C0:CA:40:AE:5F
security=802-11-wireless-security
[802-11-wireless-security]
key-mgmt=wpa-psk
auth-alg=open
psk=[TOOK OUT MY KEY]< you get the idea. 
[ipv4]
method=auto
[ipv6]
method=auto
1
  • This dir does not seem to contain all the saved passwords. I don't know if it's because I've used nmcli to add some of them, but I can definitely say that there are networks for which credentials are remembered, and that do not have said credentials stored here. Where are they, then?
    – appas
    Sep 26, 2016 at 17:56
-2

It is stored in /etc/network/interfaces and is not encrypted!

2
  • It isn't stored in /etc/network/interfaces! Oct 2, 2013 at 23:02
  • It used to be, just many years ago.
    – Oli
    Nov 4, 2013 at 11:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .