Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Is is possible to run the passwd command with an option to show the newly entered passwords? By default it doesn't show what I type and I don't want this.

[dave@hal9000 ~]$ passwd 
Changing password for user dave.
Changing password for dave.
(current) UNIX password: 
New password: bowman
Retype new password: bowman
passwd: all authentication tokens updated successfully.
share|improve this question

migrated from serverfault.com May 15 at 14:10

This question came from our site for professional system and network administrators.

    
You mean you want to see a password someone entered? If so...no. –  Bart Silverstrim May 15 at 0:52
2  
I think OP is asking how to enable input echo at the "Enter new UNIX password" prompts. Maybe? –  jscott May 15 at 1:54
1  
@jscott right, thats what I mean –  Kompi May 15 at 2:14
2  
What are you trying to accomplish with this? This is not a good idea –  edvinas.me May 15 at 13:36
    
Just wanted to use this in a local virtual machine, where security is not really a concern –  Kompi May 17 at 10:41

2 Answers 2

up vote 5 down vote accepted

If you really want to go this path and there's no passwd parameter, you can use this Expect script:

#!/usr/bin/env expect -f
set old_timeout $timeout
set timeout -1

stty -echo
send_user "Current password: "
expect_user -re "(.*)\n"
set old_password $expect_out(1,string)

stty echo
send_user "\nNew password: "
expect_user -re "(.*)\n"
set new_password $expect_out(1,string)

set timeout $old_timeout
spawn passwd
expect "password:"
send "$old_password\r"
expect "password:"
send "$new_password\r"
expect "password:"
send "$new_password\r"
expect eof

How it works:

[dave@hal9000 ~]$ ./passwd.tcl
Current password: 
New password: bowman
spawn passwd
Changing password for user dave.
Changing password for dave.
(current) UNIX password: 
New password: 
Retype new password: 
passwd: all authentication tokens updated successfully.

This shell script might also work (tested on Fedora 20 with bash-4.2.47-2 and passwd-0.79-2):

#!/bin/sh
stty -echo
echo -n "Current password: "
read old_password

stty echo
echo
echo -n "New password: "
read new_password

passwd << EOF
$old_password
$new_password
$new_password
EOF

How it works:

[dave@hal9000 ~]$ ./passwd.sh
Current password: 
New password: bowman
Changing password for user dave.
Changing password for dave.
(current) UNIX password: New password: Retype new password: passwd: all authentication tokens updated successfully.
share|improve this answer

You're not completely clear on what exactly you are trying to see...your own password? Someone else's?

As I recall even the OS doesn't really know your password because it's hashed. You can clear a password from the shadow file, effectively blanking it (by booting from another boot disk, usually) then re-enter the password, but snatching the actual password would entail cracking the hashed string...brute forcing it or using a dictionary attack, rainbow tables or something like that. I'll leave the mechanics to your Google-fu.

So in short; no, you can't retrieve the password without intercepting and recording keystrokes, but you can erase the password if you have physical access to the drive (or image).

EDIT: Ah, clarified to show what you're typing as you type it. Again, nope, not in any version I know of. I believe this is to prevent shoulder surfing; people looking over your shoulder as you type, or remotely viewing your display as you type.

If you want to work around it (if you're using a GUI, for example) you can cut and paste your text string into the prompt, although that would usually be a pain. It depends on why you are wishing to echo your text (why bother double entering the password if you can see what you're typing...that was the point to having you re-enter your password, to cut down on typos.)

Depending on how your version of Linux works I suppose you could try directly hashing a password string and entering that resulting hash into the shadow file...kind of a strange workaround but one that may work. Or you could find an odd workaround wherein you have a PAM module authenticate against a different system/database that you can alter more directly. But anything that reveals your password at some stage through plain text is kind of asking for trouble from a security standpoint...you would need to decide how much risk you're willing to take.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.