3

After reading this article, I'm properly paranoid that Linux is storing passwords on my disk somewhere that I'm not aware of. As a person with an above average preference for privacy, I don't tend to save anything beyond WEP keys, and it's a little distressing to think that they might be on my disk waiting for someone to just snatch in plaintext.

How much of a concern is this for security in general?

Thanks, Joe

2
  • 13
    If you're that concerned about security, you should use WPA2 and not WEP. I can sit outside you house and be on your WEP network in 15 minutes with a copy of aircrack.
    – MDMarra
    Jun 30, 2010 at 22:37
  • Very much so. If your devices do not support WPA2, at least use WPA, which increases the crack time to somewhere near a day (probably wrong on that, though)
    – Hello71
    Jul 5, 2010 at 14:41

7 Answers 7

6

Assuming that the attacker doesn't have access to your system with the necessary permissions to read raw disk devices (/dev/sda and the like), and that he/she doesn't have physical access to the disks, I don't think it'd be much of a concern. As chris pointed out, the problem discussed in the article (with reference to Linux and plain-text passwords specifically) is that a password which is stored in RAM as cleartext (as it necessarily must be at some point*) could be part of a page that gets swapped out to the disk, and thus it could wind up being readable from the free space on the disk. But Linux uses separate partitions, i.e. physically disjoint parts of the disk, for swap space and file storage (unless you've configured the system to use a swap file), so an attacker who can access the disk only through the filesystem wouldn't be able to get at the part of the disk that holds swapped-out data.

If you want to check for passwords being stored on disk, in readable files, in the clear, I'd take a look at things like your web browser's password manager, and the configuration files for any programs you ever enter passwords into.

*for normal algorithms

7

Just to make clear, Linux doesn't store ANY passwords at all in plaintext... programs from developers might, but this is no different than on Windows.

1

I think the article is referring to the fact that your clear-text password may be in memory at any given time, and therefore could be found on the disk.

But practically, there are a lot more much simpler ways to steal your password. Unless you have something worth the effort, then you're probably safe.

1

From your home directory execute:

$ grep -R --exclude-dir=.. --exclude-dir=. "pwd1\|pwd2" .*

to search for pwd1 or pwd2 in your dot files and folder (a probable place to store plain text passwords).

I just found out that pidgin store plain text passwords without any shame.

1

The only password actually "saved" per se is the one stored in the passwd file, and that's encrypted.

Otherwise, it's the bits of software that you're using that is saving the password, and therefore the security lies in their hands.

Otherwise, you are vulnerable to the same security flaws as any other computer-using human being. Threats of physical violence and the similar.

There are 3 major steps to securing a computer:

  1. Don't connect your computer to the internet.
  2. Don't turn your computer on.
  3. Don't buy a computer.
3
  • 4
    there are no passwords stored in passwd since the mid 90s Jul 1, 2010 at 8:35
  • 1
    @Mugen: While technically it's true that passwords aren't in /etc/password, password hashes ARE being stored in /etc/shadow. I'd give Aatch the benefit of the doubt on that. As to his 3 steps, while a bit snarky, it's not incorrect.
    – hotei
    Sep 7, 2010 at 0:04
  • You are right - this was maybe a bit short spoken. The major difference between password hashes in passwd and shadow is the right to read them. /etc/passwd has to be readable to everyone to resolve user ids and home dirs. So anyone could take the hashes and brute force them without being recognized. /etc/shadow is only readable by root and/or a seperate shadow group. That is why it is way more secure to use shadowed passwords and as this is done for a long time now i maybe reacted a bit harsh.. sorry for that. Sep 9, 2010 at 9:24
1

Password are encrypted and stored in /etc/passwd or /etc/shadow use this command to access:

sudo vim /etc/shadow
sudo cat /etc/shadow

the first one will let you edit and the second one allow you print the content out

0
0

Use disk encryption like TrueCrypt or BestCrypt for example. http://en.wikipedia.org/wiki/Comparison_of_disk_encryption_software http://www.truecrypt.org/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .