casarchitecture.blogg.se

Net the class provides managed access to DPAPI so that PINVOKE marshalling is not necessary.Īlternitively sitemanager.xml could be entirely encrypted using AES with the passwords stored in the encrypted file, however the encryption key should be computer/user specific and stored via DPAPI.Įither route comes with drawbacks however - it makes migrating settings to new installs more difficult (can't just copy sitemanager.xml and drop it in the %appdata% directory of the new install) so that is a drawback to be aware of. They should be used with the optional entropy to further increase the difficulty in other applications extracting that information. These functions will handle encryption and key management to store the passwords. Specifically, the two functions of interest are CryptProtectData: ​ and CryptUnprotectData: ​(VS.85).aspx

Windows provides an easy mechanism to encrypt passwords using DPAPI: ​ This is generally bad security practice, as any malware that is aware of filezilla (as many are aware of and utilize stored passwords in Windows Explorer FTP) can harvest FTP credentials and upload malicious files to any stored webserver FTP addresses. On Windows, by default, FileZilla Server’s service runs as the SYSTEM user hence, if the boot drive is C:\, then the configuration files reside under C:\Windows\System32\config\systemprofile\AppData\Local\filezilla-server.For Windows Clients, in %appdata%\filezilla\sitemanager.xml the passwords are stored plaintext. On Windows, the configuration files for the server reside under %LOCALAPPDATA%\įilezilla-server and the Administration interface’ ones under %LOCALAPPDATA%\filezilla-server-gui, where %LOCALAPPDATA% is the environment variable which expands to the local AppData directory of the user that’s running the FileZilla Server’s service and FileZilla Server’s Administration interface.config/filezilla-server-gui, where ~ is the home directory of the user that’s running the FileZilla Server’s Administration interface. On Debian Linux, the configuration files for the server reside under /opt/ filezilla-server/etc/ and the ones for the Administration interface under ~/.

The location where configuration files are saved depends on the operating system FileZilla Server is running on.