0

At my workplace we use a proxy for all outgoing connections. Recently I had to install a Linux VM inside Virtual Box to be able to connect from it to the Internet. So I have configured the proxy settings in the yum.conf file. The password is in clear text in the config and one of my colleagues told me that it's a security risk because password will show as plain text and this part I don't understand. Isn't the Linux VM only authenticating against our company proxy so why should I care if it's sent in the clear? Could anyone explain ?

  • is this password common to all users on your network? – schroeder Oct 13 '17 at 22:05
  • @schroeder well, it's my Windows domain user, so I don't see the problem, because when browsing the web I'm going through the same proxy, or is the browser creating a hash of my pwd? – cyzczy Oct 25 '17 at 13:06
1

one of my colleagues told me that it's a security risk because password will show as plain text

Show where? If you connect to your proxy using HTTP, then the password will either be sent as base64 encoded (negligible improvement over plain text) or as an NTLM hash (small improvement). If this is what your proxy requires, then you have not created the problem - all the proxy users will be affected by this. If your proxy uses HTTPS, then the password is not visible on the network.

It will still be visible in the VM image if you didn't configure the instance to use encrypted storage.

Is it a problem if the account details don't stay secret inside your organization?

In a lot of environments, the web proxy is simply a way to multiplex many clients access to the internet. Sometimes there may be some filtering on the proxy. Rarely is there any per-user policy constraints - and if there are any being applied here, then the account you are using should only have access to the Redhat / Fedora / Centos repositories.

On the other hand if you are not using a dedicated account, then you could be publishing a password which might give access to all sorts of other things.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.