I was looking down at my keyboard and typed my password in because I thought I had already typed my login name. I pressed Enter, then when it asked for the password I pressed Ctrl+c.

Should I take some precautionary measure to make sure the password isn't stored in plain text somewhere or should I change the password?

Also this was on a tty on ubuntu server 16.04 LTS.

  • 10
    Your password is going to be in the log file, and you should edit it not to include your password, but even after you remove it from your log file, I would suggest that you change your password anyway just in case. Apr 24, 2016 at 21:46
  • 1
    duplicate on security se: security.stackexchange.com/questions/101172/…
    – stanri
    Apr 25, 2016 at 8:41
  • 4
    Another good reason to use SSH + public-keys from a separate PC and keep the console display & keyboard for emergencies only. Apr 25, 2016 at 13:19
  • @stacey that Q is for login to a (presumably remote) site controlled by others; this is for a local system. There is some overlap but it's not the same. Apr 25, 2016 at 14:52
  • 2
    I do not yet have any Ubuntu 16.04 system to test this on. But following the exact same steps on an Ubuntu 14.04 desktop install does not log the user name or password. You seem to have pressed ctrl-c just at the right moment to avoid your password making it to any logfiles.
    – kasperd
    Apr 25, 2016 at 18:28

3 Answers 3


The concern is whether your password is recorded in the authentication log.

If you're logging in on a text console under Linux, and you pressed Ctrl+C at the password prompt, then no log entry is generated. At least, this is true for Ubuntu 14.04 or Debian jessie with SysVinit, and probably for other Linux distributions; I haven't checked whether this is still the case on a system with Systemd. Pressing Ctrl+C kills the login process before it generates any log entry. So you're safe.

On the other hand, if you actually made a login attempt, which happens if you pressed Enter or Ctrl+D at the password prompt, then the username you entered appears in plain text in the authentication logs. All login failures are logged; the log entry contains the account name, but never includes anything about the password (just the fact that the password was incorrect).

You can check by reviewing the authentication logs. On Ubuntu 14.04 or Debian jessie with SysVinit, the authentication logs are in /var/log/auth.log.

If this is a machine under your exclusive control, and it doesn't log remotely, and the log file hasn't been backed up yet, and you're willing and able to edit the log file without breaking anything, then edit the log file to remove the password.

If your password is recorded in the system logs, you should consider it compromised and you need to change it. Logs might leak for all kinds of reasons: backups, requests for assistance… Even if you're the only user on this machine, don't risk it.

Note: I haven't checked whether Ubuntu 16.04 works differently. This answer may not be generalizable to all Unix variants and is certainly not generalizable to all login methods. For example OpenSSH does log the username even if you press Ctrl+C at the password prompt (before it shows the password prompt, in fact).

  • 13
    In the latter case you should also change it everywhere where you have reused it.
    – gronostaj
    Apr 25, 2016 at 9:53
  • 2
    Uh, correct me if I'm wrong but generally the only people who will see these logs are the ones who could already have access to your data if they wanted. So what if they see their password? What's the big deal?
    – user541686
    Apr 25, 2016 at 18:17
  • 4
    @Mehrdad Authentication logs are normally reserved to administrators, true. But there's a difference between trusting someone with the ability to install a keylogger, and trusting them with my passwords. It's also possible that a backup will leak, or that I'll share logs with someone to help with troubleshooting, etc. The risks that a log entry will leak are too high to ignore. Apr 25, 2016 at 18:25
  • 1
    If this answer is correct, then that is a regression compared to Ubuntu 14.04. Following the mentioned steps on Ubuntu 14.04 does not log user name or password, because the login was interrupted by pressing ctrl-c before that information would have been logged.
    – kasperd
    Apr 25, 2016 at 18:26
  • 2
    @kasperd Post as answer.
    – wizzwizz4
    Apr 25, 2016 at 18:30

In your case, you are safe - you've typed in a password and cancelled out of it. A password typed into login prompt followed by wrong password will be considered failed authentication and is partially recorded to btmp log. For tty console that's however alright.

$ sudo lastb                                                                   
[sudo] password for xieerqi: 
UNKNOWN  tty1                          Mon Apr 25 22:14 - 22:14  (00:00)    

The "accidentally" typed password was recorded as UNKNOWN, so all good here. However, the failed authentications at the GUI login screen do show failed login entries unobfuscated

$ sudo lastb                                                                   
[sudo] password for xieerqi: 
hellowor :1           :1               Mon Apr 25 22:17 - 22:17  (00:00)    
UNKNOWN  tty1                          Mon Apr 25 22:14 - 22:14  (00:00)    

Is there anything good about that ? Well . . .The attacker would have to have access to your system in the first place, even more so - he/she would have to have root access in order to read the btmp log. Which also means for a single user computer - that's equivalent to having your password stolen already so that entry is of no use to the attacker anyway if they know your password. The password in the entry, you can deduce already, has only partially been recorded, but that gives quite a fair advantage for an attacker, so there's nothing good about that part

Should you change the password ? Probably, just to be 100% sure.On the other hand, an attacker would have to have access to your btmp log which is the same as having access to /etc/shadow , so there's no real advantage to it .

Side note:All the output from my Ubuntu 14.04

  • It is also true that this plane text file would show the password in the log file if someone were to boot a live os on the same machine. If you use this same password elsewhere this could pose a seperate security risk. I would recommend flushing them out of the log file and using a program that over writes the freed space depending on how important this password is to you
    – Joe
    Apr 28, 2016 at 17:57
  • @Joe which specific logs we're talking about ? /var/log/auth.log ? Yeah, password reuse is a common issue , I'm well aware of it, so I don't reuse none. Apr 28, 2016 at 18:03
  • 1
    Just a side thought for others as well when they look this up as I know so many people that have 1 password for everything.
    – Joe
    Apr 28, 2016 at 18:04
  • Also should over write btmp file as well
    – Joe
    Apr 28, 2016 at 18:06
  • so, to conclude.. simply sudo rm /var/log/btmp?
    – phil294
    May 25, 2018 at 20:33

I think @Gilles answer is great. however i wanted to add emphasis by showing a bullet point of his technical points:

  1. if you logged in via text/console (i.e. not GUI) then...
  2. if you are on specific distro then...
  3. if you have sysvinit instead of systemd...
  4. if you pressed ctrl-c then...
  5. if you actually made a login attempt (pressed ctrl-d or pressed enter) then...
  6. if you have authentication logs enabled then...
  7. if your machine is offline and you are the only one with access to it then...
  8. if the machine is configured to have log authentication remotely then...
  9. if the machine is configured to have backups then...
  10. if the machine's scheduled backup has run or not then...
  11. if you know how to edit the logfile and ensure the previous version isn't saved somehow then...
  12. if you are logging in via ssh then...

That means there are 12 places where things could go wrong (probably more than 12). I think changing my password is at least 10x faster than exhaustively checking all 12 places[1]. Additionally changing your password means you have piece of mind (maybe you exhaustively checked... but missed something).

[1] and ensure that you checked correctly (i.e. finding logs, finding backup schedules, finding out how remote logging works, researching what distro/systemd-version i have AND researching how authentication logging works for that distro/systemd-version, researching what my corporate logging implementation is, researching what my corporate backup implementation is, etc etc).

p.s. one last thing. if you are on a properly managed linux machine (i.e. corporate, academic, cloud, etc) then at least one of those bullet points is true. so i would say definitely change your password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.