Retrieve Passwords

Come here to discuss FileZilla and FTP in general

Moderator: Project members

Post Reply
Message
Author
nplanek
500 Command not understood
Posts: 3
Joined: 2011-10-05 19:19
First name: Nancy
Last name: Planek

Retrieve Passwords

#1 Post by nplanek » 2011-10-05 19:47

Is there anyway to retrieve the login and password information for all my firezilla logins. We are using much more now and I didn't keep track, now I need to.

User avatar
boco
Contributor
Posts: 25385
Joined: 2006-05-01 03:28
Location: Germany

Re: Retrieve Passwords

#2 Post by boco » 2011-10-05 20:27

FileZilla

Using the client or the server?

Client: Simply export (File menu) the sites into an XML file.
Server: All account information is stored in the FileZilla Server.xml file, except the passwords. The server never stores passwords, only their MD5 hashes.
### BEGIN SIGNATURE BLOCK ###
No support requests per PM! You will NOT get any reply!!!
FTP connection problems? Do yourself a favor and read Network Configuration.
FileZilla connection test: https://filezilla-project.org/conntest.php
### END SIGNATURE BLOCK ###

nplanek
500 Command not understood
Posts: 3
Joined: 2011-10-05 19:19
First name: Nancy
Last name: Planek

Re: Retrieve Passwords

#3 Post by nplanek » 2011-10-05 20:49

It would be the server, and I guess I'm out of luck since there's no way to retrieve the password.

User avatar
botg
Site Admin
Posts: 33309
Joined: 2004-02-23 20:49
First name: Tim
Last name: Kosse
Contact:

Re: Retrieve Passwords

#4 Post by botg » 2011-10-05 21:17

Please contact your server administrator to recover from lost login credentials.

User avatar
boco
Contributor
Posts: 25385
Joined: 2006-05-01 03:28
Location: Germany

Re: Retrieve Passwords

#5 Post by boco » 2011-10-05 22:19

@botg: From her first post, she is using FileZilla Server and the server admin.

Yes, FileZilla Server doesn't save any passwords, only the MD5 hash (that's all it needs). By the way, this is the reason for all passwords getting equal length after having been entered. Since hashing is a one-way lossy operation, there would be only one way to determine potential password candidates - searching for so called collisions (source strings producing exact that hash) via brute force methods. MD5 is not collision resistant, so there may be more than one password working for a FileZilla Server account. However, actually finding the original password or one of the alternate strings has a very low chance and is very time consuming. In other words: Not worth the hassle. So I fear the best way would be to issue new ones.

@botg: Would change the hash to SHA512 be overkill? Plain MD5 is a bit weak, would need at least some salting...
### BEGIN SIGNATURE BLOCK ###
No support requests per PM! You will NOT get any reply!!!
FTP connection problems? Do yourself a favor and read Network Configuration.
FileZilla connection test: https://filezilla-project.org/conntest.php
### END SIGNATURE BLOCK ###

User avatar
botg
Site Admin
Posts: 33309
Joined: 2004-02-23 20:49
First name: Tim
Last name: Kosse
Contact:

Re: Retrieve Passwords

#6 Post by botg » 2011-10-06 06:23

@boco: Not when I originally started my previous reply, the other replies were not yet there. Regarding SHA512, I think it would be overkill. After all, nobody should have access to the settings file in the first place.

User avatar
Hugh_K
503 Bad sequence of commands
Posts: 22
Joined: 2011-03-12 12:33
First name: Hugh
Last name: Kallen
Location: Michigan, USA
Contact:

Re: Retrieve Passwords

#7 Post by Hugh_K » 2014-07-16 15:11

boco wrote:Client: Simply export (File menu) the sites into an XML file.
This was exactly what I needed for one of our newer websites. Thank you!
Last edited by boco on 2014-07-17 01:13, edited 1 time in total.
Reason: Please don't post URLs. it's against the rules.

Post Reply