How to Remove Passwords Entered by Users Inside SSH Sessions from the Logs

If users know account passwords and enter them inside SSH sessions, these passwords appear in the logs in plain text — this is JumpServer's default behavior for any user input.

To change this behavior:

1. Open the configuration file:

vi /opt/jumpserver/config/config.txt

2. Add the following line at the end of the file:

DISABLE_INPUT_AS_COMMAND=true

3. Restart the application:

jmsctl restart

After this, passwords will no longer be saved in the logs.

Note: Only passwords entered in response to a password prompt (for example, after running the sudo command) will not be logged.
If a user types their password somewhere else — for example, into a text file — the password will still appear in the command logs.