First time question.
I have a customer panel that shows the Plesk 12.5 password. For now I put that in manually when I generate the password. But customers change their password, forget it and then everything fails. I use the Plesk API to receive the password, but this is encrypted.
$5$CngpmNFXTsfRswHH$nntnTlj0KLkhEidK.XVWgbyv9HcAE8YV/fog0C6aG17
I found out that the key is found in /etc/psa/private/secret_key
.
I tried:
$res_non = mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $key, $hash, 'ecb');
$decrypted = $res_non;
$dec_s2 = strlen($decrypted);
$padding = ord($decrypted[$dec_s2-1]);
$decrypted = substr($decrypted, 0, -$padding);
But that doesn’t return my password correctly.
Any help is appreciated, Thanks!
3
Answers
Way to decrypt it, indeed, exists, but it is not public, and, probably, it will never be. Even support doesn’t know the way to decrypt it.
You can view passwords of mail users via mail_auth_view command. That’s all that can be done.
Source – I’ve worked in Plesk dev for some time.
This appears to be a sha256crypt hash, without storing the number of rounds (which means it’s likely hard-coded). If so, this isn’t encrypted. Hashing is not encryption. Hashing is a subtopic of cryptography, but is wholly separate from encryption.
Please don’t confuse the two.
How about to reset password via “Forgot your password?” on login screen?