GNOME Bugzilla – Bug 322820
vpnc backend should have group password in the properties
Last modified: 2008-04-25 12:51:59 UTC
The group password is available in the .pcf file for the Cisco vpn connections in a mildly encypted form. As that password can be decrypted using a simple libgcrypt-based program, it does not offer any particular security: http://www.unix-ag.uni-kl.de/~massar/soft/cisco-decrypt.c As such, it shouldn't be in the keyring, but available in the VPN properties.
Well, it is in mildly encrypted form in _some_ cisco pcf files. They've plugged that hole and current clients use a much stronger algorithm IIRC. So this would only fix it for certain classes of PCF files. Furthermore, there may be legal implications with attempting to decrypt this password, at least in the US...
Marking WONTFIX because group password will likely stay in keyring...
Reopening. Would it be possible to call a binary with a specific name if it was available in the path to decrypt this automatically? (ie. not in NetworkManager)
Possibly, is there anything contributory about it?
*** Bug 447222 has been marked as a duplicate of this bug. ***
We'd need to save the VPN password in one of the keyrings when importing it. The problem is that: 1) we don't load existing passwords from the keyring in auth-dialog/main.c 2) we don't know which keyring we'd need to save the data into if we were to save it in the importer Seems impossible to fix given the current architecture.