how to hide when user types passwords

[Masber]

Dear xterm community,

I am learning xterm, I have a web server with a websocket I use to connect xterm to, the web server will redirect the I/O between the xterm client and the terminal I want to run the commands to.
This works so far, however, the first thing the terminal asks is for a login and a password, unfortunately, the xterm is showing plain text as I type the password and I would like to hyde it.
Any idea how to do this?

thank you very much

[jerch]

A process prompting you for password input normally would switch the echo mode of the TTY off. Thats what you'll see with things like ssh or login. So the question is - why does it not work with your login tool? Is that self-written?

[Masber]

yes, it is self-written, I have a web client running xterm.js that communicates through websocket to a web server which acts as a proxy , the server just connects the IO streams to a container session (like docker exec). When I connect to the container I can tell TTY is off because it won't show the chars when typing the password, however, this is not happening in xterm.js.
I had no idea the server could tell the client to set off the echo mode of the TTY, how can I redirect this?

[jerch]

Here is a POSIX compatible variant as shell script:

#!/bin/sh
stty -echo
printf "Password: "
read PASSWORD
stty echo
printf "\n"

The stty commands deal with the echo mode of the TTY switching it off and on again.

[Masber]

ok, got my problem solved using the attach addon

[jerch]

Now I wonder how the attach addon may have helped you with not showing password input, and if your solution is really secure 🤔 ...

[Masber]

this was my original code managing xterm ``` const socket = new WebSocket("ws://localhost:3000/console"); const term = new Terminal({cursorBlink: true, convertEol: true}); const fitAddon = new FitAddon.FitAddon(); term.loadAddon(fitAddon); term.open(document.getElementById('terminal')); fitAddon.fit(); function init() { if (term._intialized) { return; } term._initialized = true; term.prompt = () => { term.write('\r\n$ '); }; prompt(term); term.onData(e => { switch (e) { case '\u0003': // Ctrl+C term.write('^C'); prompt(term); break; case '\r': // Enter runCommand(term, command); command = ''; break; case '\u007F': // Backspace (DEL) // Do not delete the prompt if (term._core.buffer.x > 2) { term.write('\b \b'); if (command.length > 0) { command = command.substr(0, command.length - 1); } } break; case '\u0009': console.log('tabbed', output, ["dd", "ls"]); break; default: if (e >= String.fromCharCode(0x20) && e <= String.fromCharCode(0x7E) || e >= '\u00a0') { command += e; term.write(e); } } }); } function clearInput(command) { var inputLengh = command.length; for (var i = 0; i < inputLengh; i++) { term.write('\b \b'); } } function prompt(term) { command = ''; term.write('\r\n$ '); } socket.onmessage = (event) => { term.write(event.data); } function runCommand(term, command) { // if (command.length > 0) { clearInput(command); socket.send(command + '\n'); return; // } } ``` and this is now ``` socket = new WebSocket("ws://localhost:3000/console/" + route.params.xname); const attachAddon = new AttachAddon(socket); term.loadAddon(attachAddon); term.loadAddon(fitAddon); term.open(document.getElementById('terminal')); ```

…

________________________________ From: jerch ***@***.***> Sent: Saturday, 29 April 2023 10:29 To: xtermjs/xterm.js ***@***.***> Cc: Masber ***@***.***>; State change ***@***.***> Subject: Re: [xtermjs/xterm.js] how to hide when user types passwords (Discussion #4497) Now I wonder how the attach addon may have helped you with not showing password input, and if your solution is really secure 🤔 ... — Reply to this email directly, view it on GitHub<#4497 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAFQJEA2QAFS52YLZ4MUKMTXDTGNJANCNFSM6AAAAAAXPEUBCM>. You are receiving this because you modified the open/close state.Message ID: ***@***.***>

[jerch]

@AnanduP03 Well thats not how the TTY/PTY is meant to work - instead the idea is, that the foreground application is in control what to make of input or whether to echo things, while the terminal is rather dumb. Thats the reason why every single input is forwarded to the PTY as it comes in. Then the PTY + app deside what to make of the data and how to react on it.

What you want is a "local echo mode", which xtermjs does not implement itself. Sure you can do that, but better be prepared for all sorts of ugly issues like line editing caps. If you have a good enough working impl you can hook it between onData and the websocket as a gatekeeper only sending data whenever you need.

[AnanduP03]

see my terminal emulator in the web doesn't actually had a terminal behavior and i have a docker container started in interactive mode with websocket connection set up.
so when the terminal loads up it connects to the websocket connection and when the user types something and presses enter it will sent that over the socket and the socket will take the data and execute it in the terminal and the resposne is sent back to the emulator and that is being displayed

i used this configuration to take data from the user
let commandEntered = "";
term.onData((data) => {
// console.log(data);
term.focus();
if (data === "\r") {
if (commandEntered === "clear") {
term.clear();
}else if(commandEntered==="exit"){
term.writeln("\r\nWarning!!!")
term.write("Your connection will be closed");
// term.writeln("\r\n");
ws.send("");
}
else {
ws.send(commandEntered);
console.log(commandEntered);
}
commandEntered = "";
} else if (data === "\x7F") {
if (!commandEntered == "") {
let line = term.buffer.active
.getLine(term.buffer.active.cursorY)
.translateToString()
.trim();
if (line) {
line = line.slice(0, line.length - 1);
commandEntered = commandEntered.slice(0, commandEntered.length - 1);
console.log(commandEntered);
term.write("\b \b");
}
}
}
else {
commandEntered = commandEntered + data;
console.log(commandEntered);
term.write(data);
}
});

but when i added attach addon it brought the ability to go back to previous command and all by sending the up arrow keystroke to the server and the response being shown to the emulator
but the issue whenever i type something it will directly sent through the socket which i dont want to happen when i'm typing a command.

[AnanduP03]

and i'm sorry if i misunderstood the above guys implementation. Mine is a webpage with a terminal emulator on it . the terminal is supposed to behavior like an actual terminal so the best idea i had was to implement the same by connecting it to a docker container with pty enabled.

and no my case is not just to get a local echo, which in my case if i type echo it will get executed in the docker terminal and will be returned as the response to the terminal emulator

[jerch]

Well, the commands you try to hijack are already in the shell semantics - why bother to intercept & overload them? Getting this right is a non-trivial task, as you would have to preprocess input and hold it back until your logic decides to let it pass. For this to work you have to implement a comprehensive local echo mode (your term.onData(data => {... term.write() ...} is the beginning of that).

On the opposite - completely relying on the PTY + shell removes all your custom code and reduces the data transport to term.onData(data => sendToBackend(data)).

[AnanduP03]

hmm so using my old configuration will be the best possible way.
then i will have to store all the commands user entered to an array which can then be iterated for getting the previous commands. I guess that will be the easiest way possible