Home / ubuntu / Questions / 22174
Accepted
Scaine
Asked: 2011-01-19 13:03:33 +0800 CST

Where does network-manager store WPA keys when "Available to All Users" is ticked?

  • 772

When you connect to a new SSID network via the network manager applet, the key for that network is stored in gnome-keyring under the "login" keychain.

But when you then change (edit) that network to be "Available to all users", the password moves somewhere else. I'd like to know where, because if it's a PEAP network, that's effectively your Active Directory password.

alt text

Background I tick most WIFI networks as "available to all users" not to actually make them available (it's a single-user laptop anyway), but rather to prevent anyone from seeing my password for that network in clear text simply by right clicking on the network, clicking on security tab and ticking "show password". This is because when you make a network "available to all users", the act of editing that network triggers a system prompt via policykit.

This is the same reason I instantly un-install Seahorse after a fresh install. Crazy security risk allowing this.

10.10

3 Answers

  1. Best Answer

    I don't have an wifi to check it right now, but according to http://live.gnome.org/NetworkManager/SystemSettings , system connections should be stored at /etc/NetworkManager/system-connections/ .

    • 12

  2. Assuming that we all know how wireless authentication happens between a client and server/router, your machine will try to 'remember' the Access point name to help us not keep putting in the same key over and over again.

    All networks 'remembered' keys are unencrypted and stored in:

    /etc/NetworkManager/system-connections

    if we cat out one of the files you will see: (this is my box)

    [connection]

id=Auto FLPHF
uuid=495d8230-53bd-4df5-812a-374526fdb031
type=802-11-wireless
[802-11-wireless]
ssid=FLPHF
mode=infrastructure
mac-address=00:C0:CA:40:AE:5F
security=802-11-wireless-security
[802-11-wireless-security]
key-mgmt=wpa-psk
auth-alg=open
psk=[TOOK OUT MY KEY]< you get the idea. 
[ipv4]
method=auto
[ipv6]
method=auto
    • 4

  3. It is stored in /etc/network/interfaces and is not encrypted!

    • -1