Retrieve user passwords without resetting them

[bdial]

no answer yet? I think my answer was pretty good. Although it may take a bit of work. Maybe I didn't explain it properly.

Of course existing passwords are pretyt much unretrievable, that much is clear since I think they're already SHA encrypted and maybe you could try cracking them but that seems rather pointless. For existing passwords you're going to have to ask the users, or wireshark them I guess.

Anyway, openldap, which zimbra uses for it's store can be configured to store passwords as plain text. this is done by adding

password-hash {CLEARTEXT}

to the slapd.conf. This assumes zimbra's openldap hasn't been built with --disable-cleartext. Now when your users change hteir pasword, it should store them in plain text in the zimbra ldap server, and thus with the ldap root dn password you can view anyone's password.

Can any dev confirm this should work?

[dwmtractor]

Originally Posted by PNE

Quite interesting discussion but as already said, no answer so far. How about this - look at /opt/zimbra/log/mailbox.log and you will find out that for POP3 sessions passwords are logged here. I still run a 4.5 version so I do not know if this is still valid in more recent versions and I do not know right now if you need to turn on some more detailed logging but passwords are definitely there. You just need to find password for the latest successfull login.

I could be wrong here (I have been before ) but I think that's only going to be true if you have "allow clear text login" enabled as an option for POP3, which a lot of us paranoids would strongly counsel against. Plus it'd only be true for POP3 logins, not for web client logins which are over a secure connection.

Remember that if you enable clear text login, not only can you recover passwords from the log, but any fool with a sniffer can recover passwords from your network connection. If that doesn't bother you, so be it, but it would bother me.

[quanah]

And of course, anyone with a password sniffer who wants to sniff the LDAP traffic for bind operations can get the password too, as long as it is an unencrypted bind. It would be far simpler to set up an AUX objectClass to store a question and answer set of attributes, and then set up a password reset page that uses a user selected question/answer set. You could even limit what questions they get to use. Like a lot of sites do.