3 ms·

I found out the other day that DreamHost also stores control panel passwords in the clear.

by agentq 17y ago

nfriedly 17y ago
They also store ftp and database user passwords in clear text. In fact, the used to show the ftp user passwords in their control panel. Now it's hidden, but you can still access ftp user passwords via their api and you can get MySQL user passwords by doing a "one-click install" of something and then opening the config file.
- andfarm 17y ago
  Correct. If having user service passwords stored in our database bothers you, log into a shell account and change the password with "passwd". We'll pick up the new password hash on our next user config and store the password internally as "changedbypasswd". You can also view MySQL user passwords by clicking on the username in the panel (https://panel.dreamhost.com/index.cgi?tree=goodies.mysql https://panel.dreamhost.com/index.cgi?tree=goodies.mysql). This shouldn't be a big deal, though, as you have to store the passwords in the clear in config files anyway.
intranation 17y ago
Citation...?
samdk 17y ago
Network Solutions also stores FTP passwords in cleartext, and anyone with access to the overall account can easily look them up.
andfarm 17y ago
We do not store control panel passwords "in the clear". They are stored as a hash and in a reversibly encrypted form; access to the plaintext passwords is heavily logged. We are considering removing it entirely -- the only reason we currently store panel passwords in any reversible format is because we frequently get emails from users who have forgotten their panel password and want us to email it to them.
aw3c2 17y ago
Ah, Dreamhost. Where I got this support answer gem for a load average of 15+ on my shared server: After looking at the ping and traceroutes, this is not an issue of server slowness, but of the connection slowness from DE to the United States, and as such there is nothing I can do to assist you in this matter.

I found out the other day that DreamHost also stores control panel passwords in the clear.

by agentq 17y ago

I found out the other day that DreamHost also stores control panel passwords in the clear.

They also store ftp and database user passwords in clear text. In fact, the used to show the ftp user passwords in their control panel. Now it's hidden, but you can still access ftp user passwords via their api and you can get MySQL user passwords by doing a "one-click install" of something and then opening the config file.

andfarm 17y ago
Correct. If having user service passwords stored in our database bothers you, log into a shell account and change the password with "passwd". We'll pick up the new password hash on our next user config and store the password internally as "changedbypasswd". You can also view MySQL user passwords by clicking on the username in the panel (https://panel.dreamhost.com/index.cgi?tree=goodies.mysql https://panel.dreamhost.com/index.cgi?tree=goodies.mysql). This shouldn't be a big deal, though, as you have to store the passwords in the clear in config files anyway.

intranation 17y ago

Citation...?

samdk 17y ago

Network Solutions also stores FTP passwords in cleartext, and anyone with access to the overall account can easily look them up.

andfarm 17y ago

We do not store control panel passwords "in the clear". They are stored as a hash and in a reversibly encrypted form; access to the plaintext passwords is heavily logged. We are considering removing it entirely -- the only reason we currently store panel passwords in any reversible format is because we frequently get emails from users who have forgotten their panel password and want us to email it to them.

aw3c2 17y ago

Ah, Dreamhost. Where I got this support answer gem for a load average of 15+ on my shared server: After looking at the ping and traceroutes, this is not an issue of server slowness, but of the connection slowness from DE to the United States, and as such there is nothing I can do to assist you in this matter.