Please enable e.g. vmm userpassword add@ress - so that the password can be read from stdin and doesn't ever show up in the process list.
also sprach martin f krafft <madduck@debian.org> [2015-11-10 13:22 +1300]: Actually, just read from stdin when it's not connected to a terminal.