Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

In order to reboot my VPS, lxadmin requires me to type in my root password in clear text.

Is this a security oversight or am I missing something?

share

locked by HopelessN00b Apr 9 at 19:46

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

closed as off-topic by HopelessN00b Apr 9 at 19:45

  • This question does not appear to be about server, networking, or related infrastructure administration within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

    
Is this over HTTPS? I'd want them to add 'autocomplete="off"' to the form field, but if it's HTTPS this isn't a huge issue. –  ceejayoz May 30 '09 at 3:03
    
Yes, it's over https, but why not just put in type="password" so that people standing around (or watching on remote connection) don't see you type in the root password (!). –  Edward Tanguay May 30 '09 at 3:13
    

2 Answers 2

Is this a security oversight or am I missing something?

It looks like a security oversight to me. File a bug or complain. Since you are probably not rebooting very often you probably don't have to hit that page very often, so the risk seems minimal. On the other hand, that does make me wonder what other silly security related things they have done.

share

Probably a known issue.

http://www.milw0rm.com/exploits/8880

Not a lot of point reporting it

http://www.itwire.com/content/view/25559/53/

share

Not the answer you're looking for? Browse other questions tagged or ask your own question.