Foren

Home » Liferay Portal » English » 3. Development

Kombinierte Ansicht Flache Ansicht Baumansicht
Threads [ Zurück | Nächste ]
toggle
Jignesh Vachhani
Password Decryption
10. Februar 2012 04:18
Antwort

Jignesh Vachhani

Rang: Liferay Master

Nachrichten: 780

Eintrittsdatum: 10. März 2008

Neue Beiträge

Hi Everyone,

I want to decrypt all user passwords from md5 format.
I want it in plain text .

As per my knowledge decryption doesn't support in liferay for security purpose.
If anyone have idea, how can we do that ? then please share it .
Jelmer Kuperus
RE: Password Decryption
10. Februar 2012 05:20
Antwort

Jelmer Kuperus

Rang: Liferay Legend

Nachrichten: 1192

Eintrittsdatum: 10. März 2010

Neue Beiträge

MD5 hashes are designed to be non reversible. Do there is no easy way to reliably obtain the plain text passwords (other than brute force or dictionary attacks)
Jignesh Vachhani
RE: Password Decryption
12. Februar 2012 23:05
Antwort

Jignesh Vachhani

Rang: Liferay Master

Nachrichten: 780

Eintrittsdatum: 10. März 2008

Neue Beiträge

Thanks Jelmer,

I was looking for this final answer only as i was little bit confused.
Once again thanks a lot for your reply.
Mazhar Alam
RE: Password Decryption
17. Februar 2012 00:21
Antwort

Mazhar Alam

Rang: Regular Member

Nachrichten: 188

Eintrittsdatum: 25. November 2011

Neue Beiträge

Hi Jignesh,

You can set in portal-ext.properties to access your passwords-

passwords.encryption.algorithm=NONE

Regards
Hitoshi Ozawa
RE: Password Decryption
17. Februar 2012 03:13
Antwort

Hitoshi Ozawa

Rang: Liferay Legend

Nachrichten: 7990

Eintrittsdatum: 23. März 2010

Neue Beiträge

passwords.encryption.algorithm=NONE


This will store your password in plain text. This means your db admin would be able to see all including admin's password.
Also, be aware that you have to set this before you first startup Liferay because changing password encryption may result in not being able to login.
Mazhar Alam
RE: Password Decryption
17. Februar 2012 03:51
Antwort

Mazhar Alam

Rang: Regular Member

Nachrichten: 188

Eintrittsdatum: 25. November 2011

Neue Beiträge

I agree that the passwords changes into plain text.

Is there any means to fetch the Password from the database table of any respective user.?

Thanks in advance
Hitoshi Ozawa
RE: Password Decryption
17. Februar 2012 17:21
Antwort

Hitoshi Ozawa

Rang: Liferay Legend

Nachrichten: 7990

Eintrittsdatum: 23. März 2010

Neue Beiträge

After you set the password to be in plain text, you'll be able to look at the column "password_" in the table "user_".

You may be able to use Liferay api to get the user and do user.getPassword()
Arcko Duan
RE: Password Decryption
17. Februar 2012 22:06
Antwort

Arcko Duan

Rang: Regular Member

Nachrichten: 202

Eintrittsdatum: 15. Oktober 2007

Neue Beiträge

You could change to use other encryption method like DES for your password.
Jignesh Vachhani
RE: Password Decryption
19. Februar 2012 22:54
Antwort

Jignesh Vachhani

Rang: Liferay Master

Nachrichten: 780

Eintrittsdatum: 10. März 2008

Neue Beiträge

Thanks to all guys,

As passwords are saved in encrypted format in my DB.
But I think I need Decrypted formated passwords from DB and as per the suggestion given by Jelmer its not possible.
Ravi Kumar Gupta
RE: Password Decryption
19. Februar 2012 23:31
Antwort

Ravi Kumar Gupta

Rang: Liferay Legend

Nachrichten: 1146

Eintrittsdatum: 23. Juni 2009

Neue Beiträge

i guess when Liferay stores password in session(see properties file) it stores when user is logging in. And no way we can decrypt password from a hash.

Jignesh, If you are in need to get password from db. You can write your own algo to encrypt and decrypt like RSA(or simply use RSA). You can have public and private key per portal to encrypt/decrypt passwords only using keys of that portal. This way even admin will not be able to get passwords simply and it will be secure.

HTH
Jignesh Vachhani
RE: Password Decryption
19. Februar 2012 23:36
Antwort

Jignesh Vachhani

Rang: Liferay Master

Nachrichten: 780

Eintrittsdatum: 10. März 2008

Neue Beiträge

Yes Thats Right Ravi,
So for confirmation only I just posted this thread so now if any other users have this kind of requirement, they can get nice answers from here.
Thanks to all who have contributed their answers here.
Mazhar Alam
RE: Password Decryption
21. Februar 2012 21:17
Antwort

Mazhar Alam

Rang: Regular Member

Nachrichten: 188

Eintrittsdatum: 25. November 2011

Neue Beiträge

Hi ravi,

You told that Liferay stores password in session i.e in some property file ,it stores when user is logging in- so can you please tell me in which property file it stores the password.

Thanks in advance.
Ravi Kumar Gupta
RE: Password Decryption
21. Februar 2012 21:24
Antwort

Ravi Kumar Gupta

Rang: Liferay Legend

Nachrichten: 1146

Eintrittsdatum: 23. Juni 2009

Neue Beiträge

Mazhar, Its not stored in property file. We use a property so that liferay understands and stores password in session when user logs in.

See this property
1
2    #
3    # Set this to true to store the user's password in the session.
4    #
5    session.store.password=false
Mazhar Alam
RE: Password Decryption
21. Februar 2012 22:16
Antwort

Mazhar Alam

Rang: Regular Member

Nachrichten: 188

Eintrittsdatum: 25. November 2011

Neue Beiträge

Ok Ravi, got it.
Thanks!
Ashok Sangi
RE: Password Decryption
27. Februar 2012 22:59
Antwort

Ashok Sangi

Rang: New Member

Nachrichten: 10

Eintrittsdatum: 21. November 2011

Neue Beiträge

hi majhar

if i follow yours posted ans can i see all the plain text passwords in d.b
Ravi Kumar Gupta
RE: Password Decryption
28. Februar 2012 23:32
Antwort

Ravi Kumar Gupta

Rang: Liferay Legend

Nachrichten: 1146

Eintrittsdatum: 23. Juni 2009

Neue Beiträge

Hi Ashok,

You will see all the passwords in plain text in db after setting that property. But it should be done at the first start up of the portal. So that Liferay can build database accordingly.

-Ravi
Mazhar Alam
RE: Password Decryption
2. März 2012 03:09
Antwort

Mazhar Alam

Rang: Regular Member

Nachrichten: 188

Eintrittsdatum: 25. November 2011

Neue Beiträge

Ashok,
Yes u can see all the passwords in plain text.
Also
Go through ravi's comment too. :-)
Ashok Sangi
RE: Password Decryption
26. März 2012 03:52
Antwort

Ashok Sangi

Rang: New Member

Nachrichten: 10

Eintrittsdatum: 21. November 2011

Neue Beiträge

thank you , now i can see the plain text pwds