@Rick Spencer,
Last time we discussed this bug :
- The desktop team mentioned that sudo-less desktop will *never* be achieved.
And it is highly unlikely that Ubuntu desktop will /ever/ ship without sudo.
- The team dont want to take responsibility for the change [fearing backlash
from the
Jamie, you were perfectly clear. I was asking your opinion on a new
design possibility that the security team had not considered. What is
the team's position on the design I proposed? Thanks.
If even that would be unacceptable, then this bug should be marked Won't
Fix. If it would be acceptable,
Sorry, I missed comments 60 and 62. My mistake. :-) In that case, this
is Won't Fix.
** Changed in: hundredpapercuts
Status: Confirmed = Won't Fix
** Changed in: sudo (Ubuntu)
Status: Opinion = Won't Fix
--
Entering password in Terminal gives no visual feedback
Heh, shouldnt have told mpt to look at comment #60 ;p
--
Entering password in Terminal gives no visual feedback
https://bugs.launchpad.net/bugs/194472
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
--
ubuntu-bugs mailing list
This bug is about coherence.
The advocates for the change say that desktop applications give password
feedback, so sudo should do as well. I advocate against the change for
the same reason: server applications don't give password feedback, so
sudo should not as well.
The correct way to fix this
2. has no significant security impact on desktop installs when the
screensaver, policykit, gksu, and gdm (kdm?) all give feedback. As
mentioned in comment #60, the asterisks are removed after pressing
Enter, but it is recommended that this happens for all of gnome-
terminal, konsole,
** Changed in: sudo (Ubuntu)
Status: Won't Fix = Opinion
** Changed in: hundredpapercuts
Status: Triaged = Opinion
--
Entering password in Terminal gives no visual feedback
https://bugs.launchpad.net/bugs/194472
You received this bug notification because you are a member of Ubuntu
I'm very skeptical that there is a real problem here to be solved, or a
fix that would be any better than any proposed fix. I also don't see
this debate ever coming to a conclusion. I understand that a few users
are initially stumped by this, but in my opinion, we should be focusing
our polishing
I understand that there are very strong belives here. If devs think,
that the asterisks should not be shown, then this is fine with me. But
why not just edit the text which is displayed when someone opens a
terminal? Please read what I wrote in the first posting of this issue...
--- cut ---
Until
mpt: Sorry I wasn't clear; we feel sudo password feedback on the server
is undesirable since it introduces an avenue to enumerate the password
length where one did not exist before.
--
Entering password in Terminal gives no visual feedback
https://bugs.launchpad.net/bugs/194472
You received this
we should be focusing our polishing efforts elsewhere, and leave the
CLI optimized for people who need or prefer it.
So is there a papercut for taking the terminal out of the desktop .iso
by default and then forcing desktop users to install it via Synaptic if
they want it? Or taking all terminal
My main objection is that if this is enabled only for Desktop, suddenly
the behavior of sudo changes based on what ISO a person installed from.
This seems confusing.
--
Entering password in Terminal gives no visual feedback
https://bugs.launchpad.net/bugs/194472
You received this bug
I should clarify a bit more. This would be a change visible at the
command line. The bulk of Desktop users will be using gksudo, and not
the command line. For those that use the command line, this would
suddenly become a difference between server and desktop installs. It may
cause package merge
The security team has consensus for the security impact which I will
detail in this comment. As developers, we have other concerns which will
hopefully also be considered, and we will comment separately.
There are security implications to visual feedback of passwords. The
security team feels this
As a developer, I agree with Kees and feel that having different sudo
defaults for different Ubuntu installations is odd and confusing for
people new to Ubuntu. New Ubuntu desktop users should not be directed to
open a terminal and type sudo commands at all, and should be directed to
use the
New Ubuntu desktop users should not be directed to open a terminal and
type sudo commands at all
How are you going to enforce that exactly? There are hundreds or
thousands of online tutorials for Ubuntu desktop installations that
involve copying and pasting commands into the terminal. And that is
I didn't say it was a reality. I said it is what should happen and that
if we pursue having different sudo configurations for desktops and
servers we may as well open another usability bug for people being
confused by this new situation. We can fix our wiki and help
documentation but if people are
The security team's perspective has been addressed sufficiently by
Jamie, I think.
One of the difficulties here is that there is no distinct line between
what is a server and what is a desktop; tasks from each are often
commingled on the same machine. Anyone who has spent any time in the
Here is where this bug stands:
The desktop team has mentioned that they will *not* veto a change regarding
this.
There are members willing to upload a change to fix this bug, but this bug was
blocked due to Security team's earlier vague comment. [which turns out to be a
concern about server
Since there is such a fine line between server and desktop use, to avoid
confusion there should be a consistent behavior--either the password has
visual feedback or it doesn't.
So if this is really a security issue (showing feedback), then there
should be no feedback ever. No dots or asterisks
This is overstated:
Security team has now discussed and mentioned their concerns and has given us
how this needs to be fixed for new desktop installs.
We have given our concerns from a security point of view as a team and
have given our views individually as developers. This does not 'need' to
jdstrand, err.. yep! of course.. ;-)
--
Entering password in Terminal gives no visual feedback
https://bugs.launchpad.net/bugs/194472
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
--
ubuntu-bugs mailing list
I'm pleased that the discussion is open again.
May I ask the Server Security team to clarify what it means 1. has a security
impact on the server where no other application gives password feedback.
Where does the security issue lie? I can't imagine a case, where anyone or any
program could see
Phillip:
This is not the 'Server Security' team, but the Ubuntu Security team. As
mentioned earlier in this thread, no other applications in the default
server install provide password feedback (eg, console login and ssh).
Therefore, a shoulder surfer cannot obtain the password length via those
Can we put the shoulder surfer myth to bed once and for all?
First of all, if your password is of any considerable length, there's no
way the human eye can tell the difference between 11 asterisks and 13
asterisks in the blink of an eye. And if your password is 12 or 13
characters long, it'll
Any chance this will get fixed in Maverick?
Quite regularly (anywhere between a couple of days and every few weeks), we get
a thread like this on the Ubuntu Forums:
http://ubuntuforums.org/showthread.php?t=1567907
Easier to count key clicks than asterisks if you're standing behind
someone. Lack
This is something that has confused a bunch of people who I have gotten
to try out Ubuntu.
--
Entering password in Terminal gives no visual feedback
https://bugs.launchpad.net/bugs/194472
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
** Description changed:
Binary package hint: sudo
Until a user entered his first sudo command he sees these lines every
time he opens a terminal
--
To run a command as administrator (user root), use sudo command.
See man sudo_root for details.
- f...@bar:~$
+ f...@bar:~$
@jdstrand: is this a security issue that is so large ,in the desktop edition,
to make sudo behave differently ?
If so , is there anything being done _actively_ to prevent feedback in other
places in the desktop ?
If not, why enforce this in sudo for the desktop edition?
This simple bug is not
My 2 cents:
For server, there are lots of other places where password behaves the
same (including login) so for consistency I wouldn't change sudo
behavior.
For desktop, in most places, privileged actions trigger a GUI pop-up in
which you enter your password (with the usual password feedback).
I see the security point issue behind this but I also see the issue.
One use case that I see for it is when I am typing in my sudo password I
don't know if I put in too many letters. I often have to CTRL C to
escape out and try again.
But I do agree this should not be on by default on server. I
gdm doesn't always provide feedback; we do that by default. It can too
hide feedback, which i would prefer. FWIW, i would hate to see this
changed in sudo. I'd rather see all other tools not providing feedback
:) But, that's just me...
--
Entering password in Terminal gives no visual feedback
Josh Leverette wrote on 2010-02-22:
Let it be known that this day, February 21, is the day that sudo moved out of
the Age of the Wizards and into the Age of Humans
Why should sudo be moved to the Age of Humans? It really doesn't belong
there. As Matthew Paul Thomas mentioned it isn't time to
@Tralalalala, then we're back in the world of Microsoft Windows, where
everything has to be done with a GUI and nobody knows the technique
behind the shell. Forums, Blogs, Wikis... all these types of media are
text based. It's much more easy, much faster, more precise and less
error-prone to use
Actually, this is easy to configure now in /etc/sudoers, as of Ubuntu
Lucid.
Edit that file and changing one line:
-Defaults env_reset
+Defaults env_reset,pwfeedback
Save that file to disk and now try:
$ sudo -k /bin/true
[sudo] password for kirkland: ***
Note that as
Giving my two cents to my previous question... Yes, I think we should
change the default /etc/sudoers configuration for Lucid to enable
pwfeedback.
I believe we should because:
a) gksudo, pinentry, kdesu, etc. all have password feedback, and it's
one-for-one with the characters typed
b) the
Per discussion in #ubuntu-hardened, the Ubuntu Security guys are opposed
to the change I proposed above.
Thus, this bug is closed, and should be handled in documentation.
I have added a section to the sudoer's documentation:
*
Seriously? #ubuntu-hardened isn't a supreme court this can be discussed
so that by reasoning with them they would see that this isn't really a
security issue. However, I do propose one final alternative. The first time
you run sudo you should get to type a number, 1 or 2, and choose whether
On Tue, 2010-02-23 at 23:25 +, Dustin Kirkland wrote:
Per discussion in #ubuntu-hardened, the Ubuntu Security guys are opposed
to the change I proposed above.
Thus, this bug is closed, and should be handled in documentation.
I have added a section to the sudoer's documentation:
*
Users new to Ubuntu will continue to use sudo and the terminal in Lucid.
One reason for that is forums and another is our own documentation. Here
is an example - and remember that without running this command no user
will be able to watch their DVDs:
sudo /usr/share/doc/libdvdread4/install-css.sh
So what about my initial proposal. Today - like every other day -
someone showed up at ubuntuusers.de and asked...
Original posting in german... http://forum.ubuntuusers.de/topic
/passworteingabe-im-terminal-nicht-moeglich-1/
Immer wenn ich im Terminal dazu aufgefordert werde mein Passwort
A Modest Proposal
On what street corner of the internet will one *not* find confusion from
newcomers of the sudo entry method? It is obvious that something is wrong...
and any who say *not* to change even the least part is being stubbornly
traditional... *how* to change? this may be the
Oh, and i do like how everyone kindly ignored my comment [#35] that
seriously owned EVERY 'its a standard!' argument on the page... no
offense, but seriously guys. The solution is ready, why won't we
implement it? The only way new users won't be found in the terminal
pretty soon after getting into
** Changed in: hundredpapercuts
Status: Invalid = Confirmed
--
Entering password in Terminal gives no visual feedback
https://bugs.launchpad.net/bugs/194472
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
--
ubuntu-bugs mailing
If it is really security-relevant for servers (which i doubt), why not
enable it just on the desktop?
Can anyone explain why this would be a security issue?
I think, if someone or a tool can read the output of the visual feedback. The
person or tool has already other ways of getting the length
** Changed in: sudo (Ubuntu)
Status: Triaged = Won't Fix
--
Entering password in Terminal gives no visual feedback
https://bugs.launchpad.net/bugs/194472
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
--
ubuntu-bugs mailing
This is highly questionable, as most Ubuntu Server users would not want
such a change. Definitely not the everyone agrees type of Papercut.
Invalidated in 20100210 meeting.
** Changed in: server-papercuts
Status: New = Invalid
--
Entering password in Terminal gives no visual feedback
** Also affects: server-papercuts
Importance: Undecided
Status: New
--
Entering password in Terminal gives no visual feedback
https://bugs.launchpad.net/bugs/194472
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
--
Adding server-papercuts task .
The server team mentioned they would have a look at this closer when they had a
dedicated server-papercuts project.
The bug already has a patch and from what Andrew mentions it shows stars
only during entry and it disappears once the users hits return ...
--
I reiterate my belief that this issue is too contentious to be a genuine
papercut.
--
Entering password in Terminal gives no visual feedback
https://bugs.launchpad.net/bugs/194472
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
--
As a server admin for a number of Linux/UNIX hosts, I would advise that
sudo is left as-is and the notification at login is updated as suggested
by the original submitter of the bug. Showing the length of a password
at the sudo prompt makes it significantly easier to perform a brute
force attack
If we expect standard Ubuntu users to use sudo, then my previous comment
applies: either sudo should show feedback for each password character
typed, or gksudo and PolicyKit should not.
But I think our long-term aim should be that sudo is used only by server
administrators and software
Closing papercut task.
As this change needs to be decided by the server team.
Before we get comments for or against the change, Desktop goal, as mpt
mentions, is to shout at any one who recommends average users to use terminal.
So let's start shouting and fix the main bug. ;-)
** Changed
mpt,
In my last comment, it is the server (or remote) administrator that I
was most thinking about, as he/she is very used to the CLI and (as
mentioned in my previous comment) are used to sudo and other programs
not giving the feedback. I haven't researched it either, but it seems
clear to me
Depending on the feedback, a shoulder-surfer could figure out how long
the password is, which could be useful in an attack. Also, if visual
feedback is enabled, it will diverge from other standard login
procedures such as 'login' and 'ssh'. This should not be the default,
but could be configurable
Thanks Andrew for you branch. It looks good to me. However, sudo 1.7.1
is required which should be merged from Debian testing.
The core issue here is whether visual feedback should be given when a
password is entered. Depending on the outcome of this decision the
proposed branch should be merged
@David Siegel:
Can we have a decision :-)
** Changed in: hundredpapercuts
Assignee: Andrew (rugby471) = (unassigned)
** Changed in: hundredpapercuts
Assignee: (unassigned) = David Siegel (djsiegel)
--
Entering password in Terminal gives no visual feedback
Why don't admins with this problem just add a message to the MOTD.
I don't think it's good idea to change sudo at all.
Kind of makes Ubuntu users look like morons.
--
Entering password in Terminal gives no visual feedback
https://bugs.launchpad.net/bugs/194472
You received this bug
Why is this a papercut? Dozens of papercuts have already been rejected
because papercuts don't apply to the command-line. Ubuntu shouldn't
trying to make the CLI user friendly - it should be fixing problems that
exist at the GUI level. Please don't apply this patch, it is not solving
a real
I'd like to have some form of visual recognition that I've typed in the
correct number of letters. I've on occasion missed a letter even though
I thought I pressed it.
Perhaps this could be a setting that could be set? For example the
default is show asterisks, but the admin could set it to
Sure I shall have a go...
** Changed in: hundredpapercuts
Assignee: (unassigned) = Andrew (rugby471)
** Changed in: sudo (Ubuntu)
Assignee: (unassigned) = Andrew (rugby471)
--
Entering password in Terminal gives no visual feedback
https://bugs.launchpad.net/bugs/194472
You received
There was a bit of confusion but all that needs to happen now is sudo
needs to be synced from debian, and the debdiff applied
--
Entering password in Terminal gives no visual feedback
https://bugs.launchpad.net/bugs/194472
You received this bug notification because you are a member of Ubuntu
** Changed in: sudo (Ubuntu)
Assignee: Andrew (rugby471) = (unassigned)
--
Entering password in Terminal gives no visual feedback
https://bugs.launchpad.net/bugs/194472
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
--
** Changed in: hundredpapercuts
Status: In Progress = Confirmed
--
Entering password in Terminal gives no visual feedback
https://bugs.launchpad.net/bugs/194472
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
--
ubuntu-bugs
Thanks Andrew , could you also mention which changes/patches from
upstream need to be cherry-picked to implement this?
** Changed in: hundredpapercuts
Status: Confirmed = Fix Committed
--
Entering password in Terminal gives no visual feedback
https://bugs.launchpad.net/bugs/194472
You
** Changed in: hundredpapercuts
Assignee: (unassigned) = Andrew (rugby471)
** Changed in: hundredpapercuts
Status: Confirmed = In Progress
--
Entering password in Terminal gives no visual feedback
https://bugs.launchpad.net/bugs/194472
You received this bug notification because you
I have just created a branch which adds to pwfeedback option by default
to the /etc/sudoers file, this means visual feedback is given when a
password is entered.
Now all that needs to be done is the new version of sudo synced across
** Branch linked: lp:~rugby471/+junk/lp-194472
** Changed in:
For whoever can update the sudo package, it needs to be the newest
version from cvs
--
Entering password in Terminal gives no visual feedback
https://bugs.launchpad.net/bugs/194472
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
--
Well I think it's best to have a notification every time when the
password is asked by sudo saying that no feedback will be given. I know
I did say it'd be best to have stars but I actually like it when no
feedback is given by terminal. I've created a patch for this. It prints
the notification
Here's a screenshot of the patch working in lucid alpha 1. Don't know
why I couldn't attach it with the patch in the earlier comment.
Also, can someone tell me why it displays Password: instead of the
usual [sudo] Password for user: . I tried to figure this out but no
luck. Would be happy if
** Changed in: hundredpapercuts
Status: Triaged = Confirmed
--
Entering password in Terminal gives no visual feedback
https://bugs.launchpad.net/bugs/194472
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
--
ubuntu-bugs mailing
There is decades-long precedent that the Unix commandline environment is
terse by default. Your patch would provoke severe irritation in a huge
userbase if applied.
--
Entering password in Terminal gives no visual feedback
https://bugs.launchpad.net/bugs/194472
You received this bug notification
Well then what could be a possible solution? Not many Ubuntu users will
appreciate the fact that terminal will give a feedback such as stars (as
many stated here) and not many new users will remember unless reminded
about this just like what Blattlaus said in comment #16. Perhaps a timed
reminder
hmm... interestingly enough, I remember something similar to this happening.
What was it? Oh yes, Ctrl-Alt-Backspace. Its been around for who knows how
long, yet it got disable recently in the default installation. However,
there is a dontzap program you can run once to re-enable that feature. I
I agree Christoph and it would be nice, if you can find there an easy
way to fix this Problem.
--
Entering password in Terminal gives no visual feedback
https://bugs.launchpad.net/bugs/194472
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to
There is no pwstars option. Upstream just added support for using a
helper program to read the password. This is not something I have time
or motivation to write, especially not for an use case where the other
half of users would cry out about changing the behaviour.
** Changed in: sudo (Ubuntu)
Then we're back at square one. What about my first proposal? Just add a
couple of words to the message which explains that you won't get a
feedback. People WILL read that, when they stumble upon this problem.
--
Entering password in Terminal gives no visual feedback
** Summary changed:
- Entering password in cmd line gives no visual feedback
+ Entering password in Terminal gives no visual feedback
--
Entering password in Terminal gives no visual feedback
https://bugs.launchpad.net/bugs/194472
You received this bug notification because you are a member of
I like Terminal not showing my password. Yes, this thing is called
Terminal. Windows has CMD, we have a Terminal, so I changed the title
of this bug report.
In the old version of GDM was also an option to not give any visual
feedback when entering the password and I always enabled this option.
Patrick Roberts (#24) seems to have made the most valid conclusion.
However, I agree with one modification: there should be an intermediary
state to disable feedback only in the terminal and leave it on in other
places. So, 3 states. Make the default state to be to show all password
entry lengths.
#24 and #25 are spot on. As a relatively new-to-linux user, this is what I
would expect and understand. One additional consideration might be to display
the explanation message (#3, et al) AFTER 2 or 3 failed sudo attempts, or
after 15 seconds, etc. This will likely cut down on the confusion
Let's not discuss unrelated topics on this bug report.
Currently gksu, PolicyKit, new GDM do show feedback and the terminal is the odd
one out here.
Adding a system-wide option is not what this bug report is about.
I dont believe there is an option in gksu, PolicyKit, new GDM to even disable
82 matches
Mail list logo
