74

I was looking down at my keyboard and typed my password in because I thought I had already typed my login name. I pressed Enter, then when it asked for the password I pressed Ctrl+c.

Should I take some precautionary measure to make sure the password isn't stored in plain text somewhere or should I change the password?

Also this was on a tty on ubuntu server 16.04 LTS.

  • 10
    Your password is going to be in the log file, and you should edit it not to include your password, but even after you remove it from your log file, I would suggest that you change your password anyway just in case. – John Militer Apr 24 '16 at 21:46
  • 1
    duplicate on security se: security.stackexchange.com/questions/101172/… – stanri Apr 25 '16 at 8:41
  • 4
    Another good reason to use SSH + public-keys from a separate PC and keep the console display & keyboard for emergencies only. – RedGrittyBrick Apr 25 '16 at 13:19
  • @stacey that Q is for login to a (presumably remote) site controlled by others; this is for a local system. There is some overlap but it's not the same. – dave_thompson_085 Apr 25 '16 at 14:52
  • 2
    I do not yet have any Ubuntu 16.04 system to test this on. But following the exact same steps on an Ubuntu 14.04 desktop install does not log the user name or password. You seem to have pressed ctrl-c just at the right moment to avoid your password making it to any logfiles. – kasperd Apr 25 '16 at 18:28
101

The concern is whether your password is recorded in the authentication log.

If you're logging in on a text console under Linux, and you pressed Ctrl+C at the password prompt, then no log entry is generated. At least, this is true for Ubuntu 14.04 or Debian jessie with SysVinit, and probably for other Linux distributions; I haven't checked whether this is still the case on a system with Systemd. Pressing Ctrl+C kills the login process before it generates any log entry. So you're safe.

On the other hand, if you actually made a login attempt, which happens if you pressed Enter or Ctrl+D at the password prompt, then the username you entered appears in plain text in the authentication logs. All login failures are logged; the log entry contains the account name, but never includes anything about the password (just the fact that the password was incorrect).

You can check by reviewing the authentication logs. On Ubuntu 14.04 or Debian jessie with SysVinit, the authentication logs are in /var/log/auth.log.

If this is a machine under your exclusive control, and it doesn't log remotely, and the log file hasn't been backed up yet, and you're willing and able to edit the log file without breaking anything, then edit the log file to remove the password.

If your password is recorded in the system logs, you should consider it compromised and you need to change it. Logs might leak for all kinds of reasons: backups, requests for assistance… Even if you're the only user on this machine, don't risk it.

Note: I haven't checked whether Ubuntu 16.04 works differently. This answer may not be generalizable to all Unix variants and is certainly not generalizable to all login methods. For example OpenSSH does log the username even if you press Ctrl+C at the password prompt (before it shows the password prompt, in fact).

  • 13
    In the latter case you should also change it everywhere where you have reused it. – gronostaj Apr 25 '16 at 9:53
  • 2
    Uh, correct me if I'm wrong but generally the only people who will see these logs are the ones who could already have access to your data if they wanted. So what if they see their password? What's the big deal? – Mehrdad Apr 25 '16 at 18:17
  • 4
    @Mehrdad Authentication logs are normally reserved to administrators, true. But there's a difference between trusting someone with the ability to install a keylogger, and trusting them with my passwords. It's also possible that a backup will leak, or that I'll share logs with someone to help with troubleshooting, etc. The risks that a log entry will leak are too high to ignore. – Gilles Apr 25 '16 at 18:25
  • 1
    If this answer is correct, then that is a regression compared to Ubuntu 14.04. Following the mentioned steps on Ubuntu 14.04 does not log user name or password, because the login was interrupted by pressing ctrl-c before that information would have been logged. – kasperd Apr 25 '16 at 18:26
  • 2
    @kasperd Post as answer. – wizzwizz4 Apr 25 '16 at 18:30
7

In your case, you are safe - you've typed in a password and cancelled out of it. A password typed into login prompt followed by wrong password will be considered failed authentication and is partially recorded to btmp log. For tty console that's however alright.

$ sudo lastb                                                                   
[sudo] password for xieerqi: 
UNKNOWN  tty1                          Mon Apr 25 22:14 - 22:14  (00:00)    

The "accidentally" typed password was recorded as UNKNOWN, so all good here. However, the failed authentications at the GUI login screen do show failed login entries unobfuscated

$ sudo lastb                                                                   
[sudo] password for xieerqi: 
hellowor :1           :1               Mon Apr 25 22:17 - 22:17  (00:00)    
UNKNOWN  tty1                          Mon Apr 25 22:14 - 22:14  (00:00)    

Is there anything good about that ? Well . . .The attacker would have to have access to your system in the first place, even more so - he/she would have to have root access in order to read the btmp log. Which also means for a single user computer - that's equivalent to having your password stolen already so that entry is of no use to the attacker anyway if they know your password. The password in the entry, you can deduce already, has only partially been recorded, but that gives quite a fair advantage for an attacker, so there's nothing good about that part

Should you change the password ? Probably, just to be 100% sure.On the other hand, an attacker would have to have access to your btmp log which is the same as having access to /etc/shadow , so there's no real advantage to it .

Side note:All the output from my Ubuntu 14.04

  • It is also true that this plane text file would show the password in the log file if someone were to boot a live os on the same machine. If you use this same password elsewhere this could pose a seperate security risk. I would recommend flushing them out of the log file and using a program that over writes the freed space depending on how important this password is to you – Joe Apr 28 '16 at 17:57
  • @Joe which specific logs we're talking about ? /var/log/auth.log ? Yeah, password reuse is a common issue , I'm well aware of it, so I don't reuse none. – Sergiy Kolodyazhnyy Apr 28 '16 at 18:03
  • 1
    Just a side thought for others as well when they look this up as I know so many people that have 1 password for everything. – Joe Apr 28 '16 at 18:04
  • Also should over write btmp file as well – Joe Apr 28 '16 at 18:06
  • so, to conclude.. simply sudo rm /var/log/btmp? – Blauhirn May 25 '18 at 20:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.