Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In order to reboot my VPS, lxadmin requires me to type in my root password in clear text.

Is this a security oversight or am I missing something?

alt text

share|improve this question
    
Is this over HTTPS? I'd want them to add 'autocomplete="off"' to the form field, but if it's HTTPS this isn't a huge issue. –  ceejayoz May 30 '09 at 3:03
    
Yes, it's over https, but why not just put in type="password" so that people standing around (or watching on remote connection) don't see you type in the root password (!). –  Edward Tanguay May 30 '09 at 3:13

2 Answers 2

Is this a security oversight or am I missing something?

It looks like a security oversight to me. File a bug or complain. Since you are probably not rebooting very often you probably don't have to hit that page very often, so the risk seems minimal. On the other hand, that does make me wonder what other silly security related things they have done.

share|improve this answer

Probably a known issue.

http://www.milw0rm.com/exploits/8880

Not a lot of point reporting it

http://www.itwire.com/content/view/25559/53/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.