3

This app uses the command line to create a WiFi access point with this command:

create_ap wlan0 eth0 MyAccessPoint

and you can also make a WPA + WPA2 network with this command:

create_ap wlan0 eth0 MyAccessPoint MyPassPhrase

but to do this you are entering the password, and it is in the terminal in plain text.

It can of course be removed from history, or never added by prepending a space to the command, but it is still typed in and is listed untill you close that terminal.

My question is if this is less secure than setting up a WiFi network with a GUI app that doesn't store it in the same way.

4
  • So... the attacker has access to your system? – muru Sep 27 '15 at 12:27
  • @muru well if they did they can do anything can't they. I'm wondering if it could be reverse engineered easier? I'm not sure how the code works. – Tim Sep 27 '15 at 13:02
  • but the command and the arguments are all local to your system, even if it sets up the WiFi. Can the attacker peek over your shoulder to look at the screen? Without some form of access to the system, I don't see how it makes a difference. Your WiFi is still protected by WPA2 (presumably) with that key. – muru Sep 27 '15 at 13:21
  • @Tim: As you're a reputation 10K user: If the below answer helped you, don't forget to click the grey at the left of this text, which means Yes, this answer is valid! ;-) – Fabby Oct 6 '15 at 11:02
3

Anything that is passed as a command line parameter can be viewed by:

  • anyone who can see the terminal contents while they still are on screen (as you said);
  • any program that has access to your history file until you remove it from there, or if you prevent it from being written (as you said);
  • any user on the system that lists the processes using ps or similar tools.

It is bad practice.

Quoting from the page you linked to: "You can pass your SSID and password through pipe or through arguments (see examples).". Adapting from https://github.com/oblique/create_ap#wpa--wpa2-passphrase-using-pipe:

  • Create a file that holds your password and make it readable only by your user:

    touch ~/.wifipass
    chmod 600 ~/.wifipass
    
  • Write into it:

    MyAccessPoint
    MyPassPhrase
    
  • Run the app with:

    cat ~/.wifipass | create_ap wlan0 eth0
    

This solves the problem of passing passwords through CLI arguments.

If you also want to encrypt the password as it is stored, you can use the gnome keyring: https://kparal.wordpress.com/2009/09/29/command-line-access-to-gnome-keyring/ and https://github.com/kparal/gkeyring This should ask for a password when you log in.

4
  • If we consider passing a password to an executable as a security issue in case the password gets stored into the command history (which it definetly can be), then it's exactly as dangerous to store it into a plain text file. No difference at all. – kos Sep 27 '15 at 3:40
  • You missed the part where I said it has the advantage of not being viewed by other users on the system that list the process with ps. But thanks for the -1. – o9000 Sep 27 '15 at 10:19
  • No, I didn't miss that, I rather missed the last link. Removed since you're not really advising to store a password in plain text, but anyway, what's the point of storing it? Why don't just <<<password create_ap wlan0 eth0, <<EOF create_ap wlan0 eth0; password; EOF or echo pasword | create_ap wlan0 eth0 (with a space at the beginning of each command)? – kos Sep 27 '15 at 11:46
  • (and reset afterwards of course) – kos Sep 27 '15 at 12:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.