Skip to content

## Bug: Passwords are stored in plain text in hosts.toml #100

Description

@DanForever

I think the one click button for automatically setting up an ssh key is awesome, when I did that via putty it was such a faff that when it eventually stopped working I couldn't remember how I'd done it and didn't want to go to the effort of setting it up again.

I logged into two devices, one runs armbian, the other runs raspberry pi os. Both created keys fine. The armbian one says "key" but the rpios one says "keyonly".

When I opened up the hosts.toml file, I saw that the password was visible for the armbian one, but not for the rpios machine. I'm not sure why it's keyonly, but I guess whatever process you have for dealing with keys doesn't clear the password from the configuration in that scenario. Although I'd expect to never see the password there considering that the "Add host" form states "for initial key setup only".

Windows has a couple of options for storing passwords in a secure manner - I've not used rust, but according to a brief internet search, you could use the "keyring crate" to handle this in a platform agnostic manner

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions