starred/LinuxGSM

Fork 0

mirror of https://github.com/GameServerManagers/LinuxGSM.git synced 2026-04-25 06:05:57 +03:00

[GH-ISSUE #3306] Clear-Text Password Revealed in Valheim PostDetails Command #2284

New issue

Open

opened 2026-02-27 03:01:59 +03:00 by kerem · 3 comments

kerem commented

2026-02-27 03:01:59 +03:00

Owner

Originally created by @PoppaShell on GitHub (Feb 25, 2021).
Original GitHub issue: https://github.com/GameServerManagers/LinuxGSM/issues/3306

User Story

When using the postdetails command on vhserver, it says it will remove passwords. And is does in the "Valheim Server Details" section where the Server Password is redacted. But in the "Command-line Parameters", the password is revealed since the password is part of the command line to launch Valheim.

Basic info

Distro: [Ubuntu 20.04.2 LTS]
Game: [Valheim]
Command: [postdetails]
LinuxGSM version: [v21.1.3]

Further Information

What the postdetails command is used, it submits it to termbin.com and returns an associated termbin url for your details. When this command is used, it is supposed to redact the password. But as described above, it does not. Because the password it also in the "Command-line Parameters" section of Details. My off the cuff idea to fix this would be to create a function that will take the server password during setup and securely store it in a config file (preferably not in clear-text) and then be able call that password into the launch command via a variable. That way the command-line only shows the variable and not clear-text password. Then when postdetails is used, it can use the current function to redact it and not have to work about it being reveled elsewhere. And if you also want to have it revealed on the terminal through the Details command, you can still do that by calling it from said function to reveal it. And if a user needs to change the password, you would also just need to leverage the original setup function to collect the password from the user and update it in the secured (non-cleartext) location.

To Reproduce

Steps to reproduce the behaviour:

Install Valheim with LinuxGSM
Configure the server with a password in the common.cfg file
Run ./vhserver postdetails from the default vhserver directory, which will output your unique termbin url
Copy/Paste that url to a browser or run it through curl
Scroll to the "Command-line Parameters" section of the Details to see the clear-text password in the command-line string

Expected behaviour

For the clear-text password not to be publicly revealed anywhere unintentionally.

Originally created by @PoppaShell on GitHub (Feb 25, 2021). Original GitHub issue: https://github.com/GameServerManagers/LinuxGSM/issues/3306 ## User Story When using the postdetails command on vhserver, it says it will remove passwords. And is does in the "Valheim Server Details" section where the Server Password is redacted. But in the "Command-line Parameters", the password is revealed since the password is part of the command line to launch Valheim. ## Basic info * **Distro:** [Ubuntu 20.04.2 LTS] * **Game:** [Valheim] * **Command:** [postdetails] * **LinuxGSM version:** [v21.1.3] ## Further Information What the postdetails command is used, it submits it to termbin.com and returns an associated termbin url for your details. When this command is used, it is supposed to redact the password. But as described above, it does not. Because the password it also in the "Command-line Parameters" section of Details. My off the cuff idea to fix this would be to create a function that will take the server password during setup and securely store it in a config file (preferably not in clear-text) and then be able call that password into the launch command via a variable. That way the command-line only shows the variable and not clear-text password. Then when postdetails is used, it can use the current function to redact it and not have to work about it being reveled elsewhere. And if you also want to have it revealed on the terminal through the Details command, you can still do that by calling it from said function to reveal it. And if a user needs to change the password, you would also just need to leverage the original setup function to collect the password from the user and update it in the secured (non-cleartext) location. ## To Reproduce Steps to reproduce the behaviour: 1. Install Valheim with LinuxGSM 2. Configure the server with a password in the common.cfg file 3. Run ./vhserver postdetails from the default vhserver directory, which will output your unique termbin url 4. Copy/Paste that url to a browser or run it through curl 5. Scroll to the "Command-line Parameters" section of the Details to see the clear-text password in the command-line string ## Expected behaviour For the clear-text password not to be publicly revealed anywhere unintentionally.

kerem added the

type: bug

distro: Ubuntu

command: post-details

game: Valheim

labels

2026-02-27 03:01:59 +03:00

kerem commented

2026-02-27 03:02:00 +03:00

Author

Owner

@PoppaShell commented on GitHub (Feb 25, 2021):

Looks like this was already submitted a few days ago in https://github.com/GameServerManagers/LinuxGSM/issues/3286.

I gave a few more details/ideas of how it could be more properly handled. So I decided to leave this open and see if those ideas are helpful.

@PoppaShell commented on GitHub (Feb 25, 2021): Looks like this was already submitted a few days ago in https://github.com/GameServerManagers/LinuxGSM/issues/3286. I gave a few more details/ideas of how it could be more properly handled. So I decided to leave this open and see if those ideas are helpful.

kerem commented

2026-02-27 03:02:00 +03:00

Author

Owner

@PoppaShell commented on GitHub (Feb 25, 2021):

Here is a fun google search if you need more "proof". =)

https://www.google.com/search?q=site:termbin.com+%22vhserver%22

@PoppaShell commented on GitHub (Feb 25, 2021): Here is a fun google search if you need more "proof". =) https://www.google.com/search?q=site:termbin.com+%22vhserver%22

kerem commented

2026-02-27 03:02:00 +03:00

Author

Owner

@dgibbs64 commented on GitHub (Mar 1, 2021):

#3286

It is disappointing that termbin is allowing the indexing of pastes. It should not do this. I will need to contact termbin about this issue to see if they will prevent indexing from happening. If they do not then I will look at other options moving forward.

I have also resolved the serverpassword issue with this pr #3315

The fix however does not obfuscate a password if a user directly copies a password into the start parameters.

@dgibbs64 commented on GitHub (Mar 1, 2021): #3286 It is disappointing that termbin is allowing the indexing of pastes. It should not do this. I will need to contact termbin about this issue to see if they will prevent indexing from happening. If they do not then I will look at other options moving forward. I have also resolved the serverpassword issue with this pr #3315 The fix however does not obfuscate a password if a user directly copies a password into the start parameters.

kerem referenced this issue

2026-02-27 03:54:59 +03:00

[PR #2284] [MERGED] fix(mcserver):correct port info #3569