Ubuntu prints the user password in the text screen that sometimes appear during power off or switching users.

TL;DR

This was a question, but after investigation it turned out to be a bug (IMHO). I've reported it on launchpad. Please check there for any updates.

Original

I have just installed Ubuntu 18.04.1 LTS (bionic) on an old machine (and maybe I only noticed that because it's a slow machine). I used the installation I got from the official Ubuntu website and I started to suspect of that even before I have installed anything else - but I took some time to believe.

I was not able to reproduce this when using just one user, however, when switching users, logging on and off, every now and then (and during power off) the text screen blinks (before the ubuntu logo with the progress dots), and in the bottom of the services statuses, there you have it: the user password!

There's nothing dodgy installed on this machine.

Here's a picture:

In this case the password appeared twice. It's hard to believe I have done anything wrong as I just installed the official release.

I'm no Ubuntu specialist. Is that considered normal?

UPDATE 1:

I found a way to easily test it. After switching users, and running:

sudo cat /dev/tty1

You can see the last passwords - actually, you can see everything which was typed in the login screen (wrong login attempts as well), which is what's also appearing during power off. I've set up a VM with the same Ubuntu version, but so far I was unable to reproduce it. So now I'm suspicious that one of the apps I've installed is actually the evildoer. I'll continue tests (basically reproducing all the steps in the VM) and post here.

UPDATE 2:

Installed all the apps, all updates, and performed all the steps I remember I have executed (switching language, configuring input, etc). I just can't reproduce it - yet the faulty machine consistently prints all keys of the login window (and only the from the login window) to /dev/tty1.

Maybe the issue lays in some driver that this old machine requires and the VM does not.

Now all I want to do is to explode this machine, but I'll make a bug report first. Then I'll reconfigure this machine from scratch and if it still has the problem, I'll update this.

UPDATE 3:

So this is the bug on launchpad.

UPDATE 4:

New install on a different machine. 18.04 from canonical, no app installed, all the updates installed - no additional app whatsoever and I was able to reproduce it. However, the symptom does not show on 4.15.0-29-generic recovery mode.

Running:

sudo lsof /dev/tty1

prints two processes, systemd-l and gdm-wayla.

Yeah, now I'm done with the subject. It is part of Ubuntu and not an external app. I'll pretend that it doesn't exist and consider that I've made my part on reporting the bug.

New here but found your problem very interesting. I believe, if you are in fact telling the truth, then some program you have installed or opened just one time has installed something of the following. To record when you enter your password.

https://unix.stackexchange.com/questions/138342/how-to-read-write-to-tty-device

Not sure if you can search the contents of each file but something like the following is what I would look for. And if you're up for a challenge, try to create one yourself, to gather that info, and that might help you find the culprit.

#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>    
int main() {
    char byte;
    int fd = open("/dev/pts/3", O_RDWR);
    write(fd, "X", 1);
    ssize_t size = read(fd, &byte, 1);
    printf("Read byte %c\n", byte);
    return 0;
}

Good Luck!

Denis