Get passwords of firebird users

Currently my application is using firebird security to log in for any user of my application.

We are using Delphi7 and Firebird 2.1.

Now we need to change this and we need to manage the access ourselves.

We are thinking about extracting all user passwords from the database (as a conversion procedure) and storing the password inside our tables ....

Is it possible to do this?

I am trying to use the delphi TIBSecurityService component but with no success.

Take a look:

var
  i: integer;
  l: TStrings;
  pwd: string;
begin
  IBSecurityService1.Attach;
  IBSecurityService1.DisplayUsers;
  l := TStringList.Create;
  try
    for i := 0 to IBSecurityService1.UserInfoCount-1 do
      l.add(IBSecurityService1.UserInfo[i].UserName);

    while l.Count > 0 do
      try
        IBSecurityService1.DisplayUser(l[0]);
        pwd := IBSecurityService1.Password;
        // pwd = ''
      finally
        l.Delete(0);
      end;
  finally
    l.Free;
  end;
end;

      

Thanks for the help!

+1


source to share


3 answers


Passwords in Firebird are hashed, so you cannot recover them.



+4


source


As far as I know, TIBSecurityService is for Interbase 6 (see its entry on the Embarcadero wiki ). I'm not sure if this component still works for Firebird 2.1 as the original Firebird was a fork of that version.

Having said that, you might not get the original password. Passwords in Firebird are encrypted using a one-way encryption algorithm as stated in the Firebird FAQ . So if this was what you intended, then it won't work.



What you can try to do is update the security2.FDB database, which contains information about users. You can do this by backing up this database to your old Firebird server and restoring it to your new Firebird server. Check this link for next steps.

NTN

+4


source


In any decent application, passwords are not stored encrypted or in plain text.

They are stored by calculating the hash of the password. The downside shouldn't be reversible, there are some weak hashing algorithms, I doubt recovery is possible without a brute-force hack.

+2


source







All Articles