Advanced

Administrator root password readable in cleartext on Ubuntu Breezy

Posted by tadelste on · 6 comments
LXer; By Tom Adelstein 		Mail this story
Print this story

Teotihuacan writes on the UbuntuForum: There is a file that contains all the installation logs :

/var/log/installer/cdebconf/questions.dat In this file, there is all the questions asked to the user abd all the user's answers. So, near the end of the file, we can find the user created during the installation... and its password (not hidden).

Moreover, this file can be read by all users (contrary to the syslog).



Personally, the user I have created during the installation is the computer administrator and I had no reason (until now) to change its password after the installation. I've just created a non-administrator user after the installation.



I have researched on this forum about this file and I have found no result. On google, there isn't many results. There is just a link to the Ubuntu Wiki (but for the installation for a cluster)



I think it's risky to store an user's password in a file readable by everybody. (for example if we can login via ssh on an Ubuntu server)



I don't know what you think of this...





He's correct. The log exists and can be read by any users.

Here's an image of it:





I simply removed the values in the file. That should do it. I'm surpirsed it took this long for some to find this issue. But it is easily fixed. It doesn't exist in Dapper. The root password is not visible in Kubuntu but you can see the user name and password.

  Nav
» Read more about: Story Type: Security; Groups: Ubuntu

» Get new stories by e-mail: nightly or as they are published

« Return to the newswire homepage

  Related stories
» More like this

Comments (6)

Fix uploaded

richo123 ·
Colin Watson uploaded a fix within an hour.
tadelste Story submitter ·
I was just thinking that maybe we should alert folks, anyway. Collin did fast work eh.
richo123 ·
Yeah you're right Tom. There is a detailed explanation of how this happned here (last post):

http://www.dslreports.com/forum/remark,15669691

It's in Kubuntu, too

joedoc ·
The article mentions that the root password isn't vissible in Kubuntu, but I can see it in my file on this Kubuntu (Breezy) desktop. Make sure you check it.
tadelste Story submitter ·
joedoc, thank you for clearing that up. I don't use Kubuntu so I had to go by the reports of others.

Post a comment

A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.

Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help

Sign up and post (it is free)  or  Log in and post