Bug 261 – Password visible when no controlling terminal

Bug 261 - Password visible when no controlling terminal


Summary:	Password visible when no controlling terminal

Status:	RESOLVED INVALID

Product:	Sudo
Classification:	Unclassified
Component:	Sudo
Version:	1.7.0
Hardware:	PC Linux

Importance:	low normal
Assigned To:	Todd C. Miller

URL:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2007-09-13 19:14 MDT by Bill Gjestvang
Modified:	2007-09-13 21:10 MDT (History)
CC List:	0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Bill Gjestvang 2007-09-13 19:14:42 MDT

Your password is visible when you type it, if there is no controlling terminal.  This is common if you run ssh with a command:

$ ssh myhost sudo ls
joe@myhost's password: 
[sudo] password for joe:mysecret
bin    usr    var
Connection to myhost closed.

If you use ssh's "-t" option to force the allocation of a tty, it doesn't happen:

$ ssh myhost sudo ls
joe@myhost's password: 
[sudo] password for joe:
bin    usr    var
Connection to myhost closed.

Comment 1 Todd C. Miller 2007-09-13 21:10:23 MDT

This is not a bug.  It is impossible to turn off echo when there is no tty present.  You can set the require_tty option if you don't want sudo to run without a tty.