Possible to get the administrator password ?

[Teotihuacan]

Hello,

I have noticed something "funny" :

There is a file that contains all the installation logs :
/var/log/installer/cdebconf/questions.dat
In this file, there is all the questions asked to the user abd all the user's answers.

So, near the end of the file, we can find the user created during the installation... and its password (not hidden).

Then, tell me if I'm wrong :
_ in the normal installation mode, the user created can get the root privileges with sudo
_ in the expert mode, there is a root account created

In both case, it's possible to get an administrator username/password.

Moreover, this file can be read by all users (contrary to the syslog).

Personally, the user I have created during the installation is the computer administrator and I had no reason (until now) to change its password after the installation. I've just created a non-administrator user after the installation.

I have researched on this forum about this file and I have found no result. On google, there isn't many results. There is just a link to the Ubuntu Wiki (but for the installation for a cluster)

I think it's risky to store an user's password in a file readable by everybody. (for example if we can login via ssh on an Ubuntu server)

I don't know what you think of this...

Bye.

[knalle]

OMG, your right, ****!

[Lord Illidan]

In Dapper, I looked at the file, and while I could see my username, I couldn't see any password.

[kittycatsexycat]

thats a bit freaky....

Cant say i've noticed that....

lol....

[knalle]

this is a MAJOR security issue i think, i did a grep on my /var for my password and stopped after just these;

/var/log/installer/cdebconf/questions.dat:Value: mypasswd
/var/log/installer/cdebconf/questions.dat:Value: mypasswd
/var/log/debian-installer/cdebconf/questions.dat:Value: mypasswd
/var/log/debian-installer/cdebconf/questions.dat:Value: mypasswd

these files are not supposed to have the password in cleartext, and if so they should be promptly removed by the installer after they have been used

thanx for this tip! Is it registered as a bug in Breezy? i mean breezy been out for a while

[knalle]

even freaking worse! the file is readable from ANY registred account, get a ubuntu breezy account and you can be root too!

karl@dundra:/media/share/games/hoi2$ less /var/log/installer/cdebconf/questions.dat

shows the root password in the terminal in clear text

[astoltz]

Just checked my qustions.dat file and the username/password is NOT there.

[knalle]

Originally Posted by astoltz Just checked my qustions.dat file and the username/password is NOT there.

good for you, i've posted this as a bug in breezy to launhpad because i've just have done a basic Breezy 5.10 install and the password shouldn't be there after install

[public_void]

OMG. That is one huge security threat. Well done in finding it.

[astoltz]

Dude, I just thought I'd add some extra info. I've also got a default Breezy install and the password is not in the above mentioned files. I'm not saying it's not a bug and that's it's not serious, just that it's not quite as simple as the password gets written to the /var/log/installer/cdebconf/questions.dat file every time.