Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

[CPANEL-21776] Mask passphrase when using cPanel to import SSH keys

Discussion in 'Security' started by Willfosho, Jul 14, 2018.

Tags:
  1. Willfosho

    Willfosho Registered

    Joined:
    Jun 18, 2018
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Sydney
    cPanel Access Level:
    DataCenter Provider
    Hi Guys,

    I'd consider this a bug in the new Git feature in cPanel72, but i guess it depends on your perspective! I guess you could also call it a feature?

    When importing keys for a repo, the passpharse field is a text field instead of a password field. This isn't overly annoying in itself, unless you're super paranoid people are looking over your shoulder. However Chrome, and most other browsers, will try to be helpful and pre-fill that passphrase in the future. It's a bit of a security concern for any shared machines.

    Is there a reason it wasn't set as a password field, or has it just been overlooked? This isn't the case when importing root ssh keys, for example.
     
    #1 Willfosho, Jul 14, 2018
  2. cPanelMichael

    cPanelMichael Technical Support Community Manager
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    45,531
    Likes Received:
    1,965
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Twitter:
    Hello @Willfosho,

    I've opened internal case CPANEL-21776 to report that characters entered in the "Passphrase" field in "cPanel >> SSH Access >> Manage SSH Keys >> Import Key" are not masked, as this is contrary to the behavior observed "WHM >> Manage root's SSH Keys”. I'll monitor this case and update this thread with more information as it becomes available.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #2 cPanelMichael, Jul 16, 2018
  3. cPanelMichael

    cPanelMichael Technical Support Community Manager
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    45,531
    Likes Received:
    1,965
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Twitter:
    Hello @Willfosho,

    Internal case CPANEL-21776 was accepted. "Passphrase" is tentatively set to become a password field in "cPanel >> SSH Access >> Manage SSH Keys >> Import Key" as of cPanel & WHM version 76.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #3 cPanelMichael, Jul 16, 2018
    scristopher likes this.
(You must log in or sign up to post here.)
Loading...
Similar Threads - [CPANEL 21776] Mask
  1. mvandemar

    Pending Publication [CPANEL-24359] Inaccurate service failure notifications sent out when license is not valid

    mvandemar, Dec 16, 2018 at 9:32 PM, in forum: E-mail Discussion
    Replies:
    2
    Views:
    117
    cPanelMichael
    Dec 17, 2018 at 12:14 PM
  2. WorkinOnIt

    In Progress [CPANEL-24474] Offer advice in the Security Advisor when the "KernelCare Gap" is in effect

    WorkinOnIt, Dec 16, 2018 at 3:06 PM, in forum: General Discussion
    Replies:
    4
    Views:
    16
    cPanelMichael
    Dec 18, 2018 at 1:04 PM
  3. KristanM

    In Progress [CPANEL-24550] Non-North American Amazon S3 backup destinations fail validation

    KristanM, Dec 14, 2018 at 6:03 AM, in forum: Data Protection
    Replies:
    8
    Views:
    113
    cPanelMichael
    Dec 18, 2018 at 1:51 PM
  4. xylin110

    SOLVED [CPANEL-24361] 500 Error when browsing to Invite and Reset Password URLs

    xylin110, Dec 12, 2018 at 9:08 PM, in forum: General Discussion
    Replies:
    4
    Views:
    229
    cPanelMichael
    Dec 13, 2018 at 11:52 AM
  5. deddy

    In Progress [CPANEL-21319] Legacy RubyGems interfaces are not functional in Centos 7

    deddy, Dec 12, 2018 at 4:51 PM, in forum: EasyApache
    Replies:
    3
    Views:
    169
    cPanelMichael
    Dec 18, 2018 at 12:07 PM

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice