The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Andrea Esposito <address@concealed>]

Greetings,

I've used the CAT configurator to setup an eduroam connection on my Arch Linux machine. It worked, correctly configuring the connection in NetworkManager (v. 1.54.1-1); the password was not saved but I could save it later by modifying the connection using NetworkManager itself. Crucially, I noticed the configurator leaves behind a cat_installer.conf file (formatted as a wpa_supplicant config file) in the $HOME/.config folder, open for any user to read, with the cleartext password associated with the eduroam identity in it. I don't know whether this is intended behavior but I assume it's not, especially considering that such file is not needed for connecting to the network, at least when using NM.

Hope this report helps and thank you for your time investigating this.

Best,

Andrea Esposito