Sentora Support Forums
FTP passwords in plain text - Printable Version

+- Sentora Support Forums (https://senforums.mach-hosting.com)
+-- Forum: General Forums - (Non-Sentora Support) (https://senforums.mach-hosting.com/forumdisplay.php?fid=1)
+--- Forum: Sentora Development (https://senforums.mach-hosting.com/forumdisplay.php?fid=54)
+--- Thread: FTP passwords in plain text (/showthread.php?tid=2617)

FTP passwords in plain text - Me.B - 02-21-2016

(02-21-2016, 04:36 AM)bbspike Wrote: I replyed some in the designtatd threads.

I forgot one thing to mention. Sentora really should stop saving the FTP passwords in plain text.

Ok let's try but I think we need an extra module in the stack..

http://www.proftpd.org/docs/directives/linked/config_ref_SQLAuthTypes.html

We need to change it. It can be done but we should test upgrade process before.

M B

RE: FTP passwords in plain text - bbspike - 02-21-2016

(02-21-2016, 05:06 AM)Me.B Wrote:
(02-21-2016, 04:36 AM)bbspike Wrote: I replyed some in the designtatd threads.

I forgot one thing to mention. Sentora really should stop saving the FTP passwords in plain text.

Ok let's try but I think we need an extra module in the stack..

http://www.proftpd.org/docs/directives/linked/config_ref_SQLAuthTypes.html

We need to change it. It can be done but we should test upgrade process before.

M B
Yes the only thing needs to be done is change the SQLAuthType to OpenSSL or Backend and change the code in the sentora module with someting like:

PHP Code:
$password = "{md5}".base64_encode(pack("H*", md5($password))); 


RE: FTP passwords in plain text - Me.B - 02-21-2016

Yep but issue is upgrading existing users....

RE: FTP passwords in plain text - bbspike - 02-25-2016

Yeah true.

I already have change a Sentora server of us. Now its stores ftp passwords as SHA512.

Updating existing users was easy:

Code:
UPDATE ftpuser SET passwd=SHA2(passwd, 512)

Above code can easily be used in the update script.

The passwd column must be set to 180 tokens for this.

RE: FTP passwords in plain text - Me.B - 02-25-2016

Ok got them

https://github.com/sentora/sentora-installers/milestones/1.0.5

Currently tagged them for next release until I sort out some fixes getting implemented for 1.0.4.

1.0.5 is due with 2 month's not that far. And may be in 1.0.4.

Thant really help.