Once in maybe ten shutdown sequences, initiated from the graphical desktop, a console flashes up for a few seconds revealing what looks like a list of the services being stopped followed by a few blank lines and then my login password in clear text (NOT the Luks pw. - I found a previous bug discussed here where the Luks pw was exposed).
Somewhat disconcerting.
I’ve tried to capture a photo of it but so rarely happens, it’s tricky to catch and you have to be quick on the draw! The only place I enter the password is on login. I suspected it might be a bug in dnf but it has happens when I haven’t entered my password that day for a dnf update, so seemed to rule that out?
Any help or pointers gladly accepted - I’ve run through it with GPT checking journalctl etc but nothing unusual then GPT loses the plot sending me in circles. lol
It’s probably because I’m using an old machine that I refused to throw away as otherwise it’s my daily driver and runs well enough for my requirements.
Many thanks.
System Details Report
Report details
Date generated: 2026-09-24 17:56:19
Hardware Information:
Hardware Model: Apple Inc. iMac14,1
Memory: 8.0 GiB
Processor: Intel® Core™ i5-4570R × 4
Graphics: Intel® Iris® Pro Graphics 5200 (HSW GT3)
Maybe video the shutdown process and dump the times it does not happen. When it does happen extract the still.
Seems bizarre though - not echoing the password into any logs or onto the screen has been a solved issue for roughly 40 years across multiple operating systems so having it pop up now feels unlikely.
Hi Steve,
I shall keep trying to catch it, of course video is the solution.
Yes, I was very surprised to see it, it’s there long enough for me to ascertain it’s my password. Makes me think perhaps I’ve been hacked and it’s some sort of key logger? I was going to wipe and re-install but I’m curious to try to catch it. I’ll try to dig down into the shutdown procedure and see where it might be happening. My Linux skills are about 15 years out of date so lots of rust!
Hey Shivank,
That would fit with the log of the services being shutdown maybe?
The password was echoed after gdm.service shutdown, I think it was.
I just did a status on that service which revealed some interesting log lines, note the “stashed password to try later in open session” hmm, worth a nose around gdm-password?
