0

I use shells running under Emacs (via M-x shell) under a variety of settings1.

In all these settings, I use the same .emacs file. Nevertheless I observe an inconsistency, as described below.

In some settings, when I run a command that requires a password (e.g. ssh) from such a shell session, the command's prompt for the password will appear in the mini-buffer, and the password itself will be hidden (as the user types, all that appears on the screen are dots).

In other settings, however, the same command will result in a prompt that appears in the main shell-interaction buffer (as opposed to the mini-buffer), and the password typed by the user will be visible.

Does anyone know what governs whether Emacs will hide passwords in such situations or not?

1 I use the term "setting" to capture a wide number of factors, including the version of Emacs, the underlying OS, whether or not Emacs is running through ssh, whether or not Emacs is running in text-only mode, and if so, the terminal emulator, whether or not Emacs is running under gnu-screen, etc.

kjo
  • 3,145
  • 14
  • 42
  • 3
    Probably, in one case the password prompt matches `comint-password-prompt-regexp` and in the other it does not. Are you sure it's the *same* command? Check the password prompt carefully. – NickD Feb 27 '23 at 22:22
  • 1
    @NickD: Your guess is a good one. Thank you! Even though the command (as I type it) is the same across the different settings, it turns out that the *password prompts* they generate vary in format from one situation to another. E.g. in one setting, ssh produces the prompt `Password for foo@bar.baz.com:`, and in another it produces the prompt `(foo@bar.baz.com) Password:`. I'd be happy to accept your comment as the answer, if you post it as such. – kjo Feb 27 '23 at 22:59
  • 1
    Posted an answer expanding on the comment. – NickD Feb 28 '23 at 01:47

1 Answers1

3

comint uses a regular expression to recognize password prompts: comint-password-prompt-regexp. It's fairly complicated in an attempt to catch as many variations as possible, but it is conceivable (and it happened apparently in this case), that the password prompts are slightly different: one matches the regexp, so the password is asked for in the minibuffer and is hidden, but the other does not match so the password is asked for as if there is nothing special and comint does not hide it.

So the solution is to either somehow make the password prompts similar enough so that they both match the regexp or to enhance the regexp so that it matches all the different prompts that you are interested in.

Do C-h v comint-password-prompt-regexp and click on the comint.el link to take you to the definition. The comment before it is indicative of the kind of madness that this regexp has to accommodate:

;; kinit prints a prompt like `Password for devnull@GNU.ORG: '.
;; ksu prints a prompt like `Kerberos password for devnull/root@GNU.ORG: '.
;; ssh-add prints a prompt like `Enter passphrase: '.
;; plink prints a prompt like `Passphrase for key "root@GNU.ORG": '.
;; Ubuntu's sudo prompts like `[sudo] password for user:'
;; Some implementations of passwd use "Password (again)" as the 2nd prompt.
;; Something called "perforce" uses "Enter password:".
;; OpenVPN prints a prompt like: "Enter Auth Password:".
;; OpenBSD doas prints "doas (user@host) password:".
;; See ert test `comint-test-password-regexp'.

The regexp is complicated so it's not easy to change correctly. Be careful!

NickD
  • 27,023
  • 3
  • 23
  • 42