The usplash package has been superseded by plymouth and has been removed
from the Ubuntu archive. Closing all related bugs.
** Changed in: usplash (Ubuntu)
Status: Confirmed = Invalid
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to
still in Karmic, unbelievable...
--
usplash prevents passwords from being not echoed on the console
https://bugs.launchpad.net/bugs/55159
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
--
ubuntu-bugs mailing list
I can confirm this bug with Jaunty and Karmic-Beta...
(Also filed a bug report: https://bugs.launchpad.net/ubuntu/+bug/454075
- might be of interest)
--
usplash prevents passwords from being not echoed on the console
https://bugs.launchpad.net/bugs/55159
You received this bug notification
Hwere's what I've found so far looking at the askpass source code:
Askpass writes to stdout, asnd this is piped into cryptsetup in the
scripts cryptroot and cryptdisks.functions
When the cryptroot script in the initramfs calls askpass, there is no
underlying terminal to take the output from
Luke, use apt-get source cryptsetup to download the source including the
debian patches. Then you’ll find debian/askpass.c in the cryptsetup
directory.
Also the website http://packages.ubuntu.com/jaunty/cryptsetup lists the
diff-file containing the askpass.c.
--
usplash prevents passwords from
to console, assuming I can find the bug in the source
code.
Date: Tue, 4 Aug 2009 12:56:58 +
From: fritsch+launchpad@in.tum.de
To: lukek...@hotmail.com
Subject: [Bug 55159] Re: usplash prevents passwords from being not echoed on
the console
Luke, use apt-get source cryptsetup
Luke lukek...@hotmail.com writes:
What source package contains the source code for the askpass.c binary? I
wanted to give this a try but never found the source of askpass.c
look in the cryptsetup, it should be in the debian/ directory. It is a
program contributed by the debian packager.
--
I could not find a debian directory in either the cryptsetup
1.0.6.orig.tar.gz source package, nor in the cryptsetup 1.0.6-7ubuntu7_i386.deb
Debian package, which does contain the 4 byte debian-binary file. The only
other things named Debain I found were things like the news.debian.gz
POSSIBLE EXPLANATION OF initramfs VS init.d BEHAVIOR:
initramfs=no console under usplash
init.d=active console under usplash
The right fix is to fix askpass.c so that no matter how you use
cryptsetup the passphrase is secure. The bug doesn't exist with a start-
of-boot passphrase call now, but
Make sure Kees Cook and/or Reinhard Tartler get this latest update:
NEW VERSION OF cryptdisks.functions gives full interactive prompting
just like askpass does, but without echoing the password to the console.
I have tested this with and without usplash, with different settings of
tries= in
/l5t7j7RRAJ98TzjlIc1pGxlnWBE91IIUq4FzZA==
=mwCZ
-END PGP PUBLIC KEY BLOCK-
Date: Fri, 10 Apr 2009 05:00:49 +
From: oxmo...@gmail.com
To: lukek...@hotmail.com
Subject: [Bug 55159] Re: usplash prevents passwords from being not echoed on
the console
Luke : Thanks for your great work. Unfortunately I get
/W0AhsMAAoJEKthnTcjVMOiQBYAnjqEF54U0HUdJ3JE
oYo/l5t7j7RRAJ98TzjlIc1pGxlnWBE91IIUq4FzZA==
=mwCZ
-END PGP PUBLIC KEY BLOCK-
Date: Fri, 10 Apr 2009 05:00:49 +
From: oxmo...@gmail.com
To: lukek...@hotmail.com
Subject: [Bug 55159] Re: usplash prevents passwords from being not echoed on
the console
Luke
I'm sorry you're right, gedit apparently didn't save! Your
cryptdisks.functions now works as expected and fixes the security issue
(no output on the console). The only problem I got is what you already
described, nothing happens when you type or when you typed a wrong
passphrase. So far, very
FIX FOR BOTH HARDY AND JAUNTY:
Some time back, I modified /lib/cnryptsetup/cryptdisks.functions to make
Usplash work to mount a non-root LUKS partition in Hardy. The working
principle is this: On b oth my AMD 64 single core and my Intel Atom, if
you type the passphrase with Usplash running while
BROADER PATCH FOR BOTH LUKS AND REGULAR MAPPINGS
After posting my patch, I realized I only wrote it for LUKS! Therefore,
I spent most of today rebooting again and again to test revisions to add
the code to the part of cryptdisks.functions that controls setting a
regular mapping as well. It
PROBLEM with non-LUKS mapping was this: usplash keeps running with NO
prompt, appearing to be a boot hang when the older cryptsetup code from
hardy (source package=1.0.5 ,deb version(s)=2:1.0.5). I have not tested
1.0.6 with a non-LUKS mapping, but the askpass binary is used in both
LUKS and
Luke : Thanks for your great work. Unfortunately I get a different
result here. I overwrited my /lib/cryptsetup/cryptdisks.functions file
by the one provided in your comment #30 and I'm still able to see my
passphrase echoed in plain text on console if I switch to console before
finishing typing
and confirmed even more !
could you guys please do ANYTHING about it ?
the current status of the system on my laptop is:
1) it starts to boot, launches usplash
2) disk activity stops and it just sits there FOREVER ! (waiting for
input ? sometimes it accepts the password, sometimes it doesn't)
ah - sorry, forget to post system-information:
system is:
Jaunty (testing), 9.04 post Alpha6-state, amd64 on an Dell m1330
--
usplash prevents passwords from being not echoed on the console
https://bugs.launchpad.net/bugs/55159
You received this bug notification because you are a member of
@Kees: Try with retry=3 and enter the password wrong 3 times. should
drop you to console
m...@titan:~$ cat /etc/crypttab
# target name source device key file options
crypt /dev/mapper/vg--raid--lvm-lvcrypt none
luks,retry=3,ciper=aes-cbc-essiv:sha256
cswap
Setting to confirmed. This bug affects lots of people.
** Changed in: usplash (Ubuntu)
Status: Incomplete = Confirmed
--
usplash prevents passwords from being not echoed on the console
https://bugs.launchpad.net/bugs/55159
You received this bug notification because you are a member of
Kees Cook : The recent updates in jaunty cryptsetup package did change
oen thing in usplash behavior :
It now show stars as you type in usplash prompt, as it already does when
usplash asks for the passphrase from initramfs (LVM encrypted install).
However, the security bug is still not fixed when
This bug is a security problem. pretty severe in my eyes. If for whatever
reason you get dropped to console after entering your harddisk password it is
readable on the screen. This can be triggered quite easily and needs a fix.
Still happens with jaunty!
If it is not fixable usplash needs to be
I cannot reproduce this issue. What are the contents of your
/etc/crypttab?
** Changed in: usplash (Ubuntu)
Importance: High = Medium
Status: Confirmed = Incomplete
--
usplash prevents passwords from being not echoed on the console
https://bugs.launchpad.net/bugs/55159
You received
Kees Cook :
# target name source device key file options
X /dev/md0 none luks
The steps described in the bug description should always reproduce the
issue. It's always reproducible for both intrepid and jaunty.
--
usplash prevents passwords from being not echoed on the console
Please close for Feisty as Won't Fix? This goes for all the other Feisty
bugs.
--
usplash prevents passwords from being not echoed on the console
https://bugs.launchpad.net/bugs/55159
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
--
** Changed in: usplash (Ubuntu Feisty)
Status: Confirmed = Won't Fix
--
usplash prevents passwords from being not echoed on the console
https://bugs.launchpad.net/bugs/55159
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
--
I can confirm that the password is echoed without a VT switch. For some
reason usplash exits while setting up the swap, a few lines over the
current cursor I’ll find my passphrase in plaintext. Which must have
been echoed there prior to exiting usplash and there was no manual vt-
switching.
--
after rereading the bugtrail, I don't see anything to fix here in the
cryptsetup package.
intrepid ships with an askpass binary, that safly asks the password
using the 'best' available means. Which includes usplash if available.
** Changed in: cryptsetup (Ubuntu)
Status: New = Invalid
--
Well, sure, since AFAIU the code, /lib/cryptsetup/askpass is used by
both the init script and the initramfs hook.
--
usplash prevents passwords from being not echoed on the console
https://bugs.launchpad.net/bugs/55159
You received this bug notification because you are a member of Ubuntu
Bugs,
Exactly! So why it works in the initramfs hook and not in the init
script? That's my main interrogation.
--
usplash prevents passwords from being not echoed on the console
https://bugs.launchpad.net/bugs/55159
You received this bug notification because you are a member of Ubuntu
Bugs, which is
good question.
Btw, does the problem only occur when you switch the VT at the usplash
password prompt, or is the password echoed also without any VT switch?
--
Gruesse/greetings,
Reinhard Tartler, KeyID 945348A4
--
usplash prevents passwords from being not echoed on the console
I assumed that the password was echoed without VT switch, but now that
you are asking for it.. I don't know, and I really wonder how we could
verify it!
--
usplash prevents passwords from being not echoed on the console
https://bugs.launchpad.net/bugs/55159
You received this bug notification
askpass.c echoes back to the commandline when it exits. I am working on
this to fix it.
---
[EMAIL PROTECTED]:~/Projects/Usplash/$ /lib/cryptsetup/askpass Test:
Test: ghghg
[EMAIL PROTECTED]:~/Projects/Usplash/$
it should be
[EMAIL PROTECTED]:~/Projects/Usplash/$ /lib/cryptsetup/askpass Test:
no wait... I'm a noob nm
--
usplash prevents passwords from being not echoed on the console
https://bugs.launchpad.net/bugs/55159
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
--
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
[EMAIL PROTECTED]:~/Projects/Usplash/$ /lib/cryptsetup/askpass Test:
/dev/null
Test:
[EMAIL PROTECTED]:~/Projects/Usplash/$
It is doing exactly as it should be :(
--
usplash prevents passwords from being not echoed on the console
https://bugs.launchpad.net/bugs/55159
You received this
** Also affects: cryptsetup (Ubuntu)
Importance: Undecided
Status: New
--
usplash prevents passwords from being not echoed on the console
https://bugs.launchpad.net/bugs/55159
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
--
The attached patch reverses last changes uploaded with cryptsetup
1.0.6-6ubuntu1 and break usplash again. This is a temporary workaround
to patch the security issue until a fix which safely permits the use of
usplash is developed.
** Attachment added: cryptsetup_1.0.6-6ubuntu2.debdiff
Saïvann Carignan [EMAIL PROTECTED] writes:
The attached patch reverses last changes uploaded with cryptsetup
1.0.6-6ubuntu1 and break usplash again. This is a temporary workaround
to patch the security issue until a fix which safely permits the use of
usplash is developed.
Well, it does not
Reinhard Tartler : That can make sense. However don't forget that this
bug doesn't happen when started from initramfs hook. The problem appears
only when started by init.d . Can askpass.c still be the problem in this
case?
--
usplash prevents passwords from being not echoed on the console
** Description changed:
- The new hires usplash causes some trouble with cryptsetup:
- Cryptsetup now uses usplash to ask the passphrase. If you switch to
- console 1, and then switch back to console 8, you'll see that your
- password was echoed in the console, in plain text.
+
Since bug 139363 has been fixed, this security issue can now be
reproduced in intrepid.
** This bug has been flagged as a security issue
** Changed in: usplash (Ubuntu)
Importance: Medium = High
Status: New = Confirmed
** Description changed:
- Binary package hint: usplash
+ The new
** Summary changed:
- [edgy] usplash prevents passwords from being not echoed on the console
+ usplash prevents passwords from being not echoed on the console
--
usplash prevents passwords from being not echoed on the console
https://bugs.launchpad.net/bugs/55159
You received this bug
43 matches
Mail list logo
