Comprehensive data protection for all workloads
Post Reply
vmNik
Novice
Posts: 6
Liked: never
Joined: Apr 10, 2015 12:14 am
Contact:

Recover ESXi password in Veeam

Post by vmNik » Apr 18, 2016 1:21 pm

Good morning.

Is it possible to view/recover via SQL a password for an ESXi host attached to VBR? A remote host password has been forgotten but has a Veeam system in place there, attached with the ESXi host in question and able to backup, restore, etc. Looking at SQL table [dbo.Credentials] in VBR8, the list of users is shown. Is there a means to get a password from SQL?

Thank you.
VCP5-DCV

nielsengelen
Veeam Software
Posts: 2772
Liked: 579 times
Joined: Jul 15, 2013 11:09 am
Full Name: Niels Engelen
Contact:

Re: Recover ESXi password in Veeam

Post by nielsengelen » Apr 18, 2016 2:21 pm

You can't recover passwords from the database.
VCP-DCV
Veeam Certified Architect (VMCA)
http://foonet.be

Gostev
SVP, Product Management
Posts: 25121
Liked: 3683 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Recover ESXi password in Veeam

Post by Gostev » Apr 19, 2016 2:32 pm 1 person likes this post

Correct, using the product UI you certainly cannot look up stored passwords.

But the code itself obviously can do this (to be able to actually leverage those credentials), so generally speaking, it is doable. But it is a manual procedure that has to be performed on backup server using some system calls. Our support can do this for you (ask them to ask me if they've never done it before).

omfk
Enthusiast
Posts: 68
Liked: 6 times
Joined: Nov 30, 2016 9:48 pm
Full Name: Frank Knappe
Contact:

[MERGED] Recover password for CIFS share

Post by omfk » Feb 10, 2017 11:23 am

Hello,

is there a way to recover the password which I set for giving B&R for a copy job towards a CIFS share?

BR
Frank

PTide
Product Manager
Posts: 5345
Liked: 471 times
Joined: May 19, 2015 1:46 pm
Contact:

[MERGED] Re: Recover password for CIFS share

Post by PTide » Feb 10, 2017 11:50 am

Hi,

Unfortunately that is not possible from the UI, however you can contact our support team and ask them to help you.

Thanks

omfk
Enthusiast
Posts: 68
Liked: 6 times
Joined: Nov 30, 2016 9:48 pm
Full Name: Frank Knappe
Contact:

Re: [MERGED] Re: Recover password for CIFS share

Post by omfk » Feb 10, 2017 7:31 pm

Thanks for the reply. I'll give it a try on Monday.

omfk
Enthusiast
Posts: 68
Liked: 6 times
Joined: Nov 30, 2016 9:48 pm
Full Name: Frank Knappe
Contact:

Re: [MERGED] Re: Recover password for CIFS share

Post by omfk » Feb 13, 2017 7:56 pm

PTide wrote:Hi,

Unfortunately that is not possible from the UI, however you can contact our support team and ask them to help you.

Thanks
The answer from the support team was negative:
"Unfortunatelly it's not possible to recover passwords from Veeam B&R 9.5. Passwords stored in Veeam are encrypted and it's not possible to recover them."

Correct or not?

BR
Frank

Gostev
SVP, Product Management
Posts: 25121
Liked: 3683 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Recover ESXi password in Veeam

Post by Gostev » Feb 13, 2017 8:08 pm

Not correct, but it is possible that they simply misunderstood your inquiry, and thought that you are talking about backup file password (and not ESXi host password).

omfk
Enthusiast
Posts: 68
Liked: 6 times
Joined: Nov 30, 2016 9:48 pm
Full Name: Frank Knappe
Contact:

Re: Recover ESXi password in Veeam

Post by omfk » Feb 14, 2017 7:27 am

I replied to their email with a picture showing the dialog in question. I'll keep you informed.

Veeam Support - Case # 02067079

BR
Frank

omfk
Enthusiast
Posts: 68
Liked: 6 times
Joined: Nov 30, 2016 9:48 pm
Full Name: Frank Knappe
Contact:

Re: Recover ESXi password in Veeam

Post by omfk » Mar 02, 2017 8:13 pm 1 person likes this post

Update:
I had a remote session with Veeam support and using a power shell script it was possible to display the password(s) in question.

Thx again
Frank

peter84
Service Provider
Posts: 1
Liked: never
Joined: Dec 28, 2015 3:27 pm
Full Name: Peter Doesberg
Location: Netherlands

[MERGED] Get ESX password out off veeam

Post by peter84 » Aug 18, 2017 1:05 pm

Hello,

The backup on our ESX host is running fine at this moment. But my colleague forgot to save our esx password in our database.
So is it possible to get the password out of veeam?

DGrinev
Veeam Software
Posts: 1815
Liked: 230 times
Joined: Dec 01, 2016 3:49 pm
Full Name: Dmitry Grinev
Location: St.Petersburg
Contact:

Re: Get ESX password out off veeam

Post by DGrinev » Aug 18, 2017 2:27 pm

Hi Peter and welcome to the community!

You cannot do that yourself using Veeam Backup & Replication UI, however, if you open a support case our team should be able to assist you with this task. Thanks!

signal
Enthusiast
Posts: 63
Liked: 3 times
Joined: Oct 06, 2016 1:19 pm
Contact:

Re: Recover ESXi password in Veeam

Post by signal » Jan 05, 2018 12:33 pm

From a security perspective, how are the passwords stored?
Are they encrypted?
I see them in the database, they are not in cleartext, but different passwords share some similar characteristics, so it can't be any form of strong encryption as that would and should produce dissimilar strings.

Gostev
SVP, Product Management
Posts: 25121
Liked: 3683 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Recover ESXi password in Veeam

Post by Gostev » Jan 06, 2018 2:55 pm

We do use strong encryption of Microsoft CryptoAPI to encrypt passwords using machine-specific encryption key, which is an industry-standard approach. It basically guarantees that the decryption can only be performed on the specific machine, so there's no need to worry if someone steals the configuration database, or takes a picture of those values, etc. Thanks!

signal
Enthusiast
Posts: 63
Liked: 3 times
Joined: Oct 06, 2016 1:19 pm
Contact:

Re: Recover ESXi password in Veeam

Post by signal » Jan 11, 2018 12:46 pm

Which CSP is used?
Which algorithm and key length is used?

Gostev
SVP, Product Management
Posts: 25121
Liked: 3683 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Recover ESXi password in Veeam

Post by Gostev » Jan 11, 2018 2:40 pm 1 person likes this post

As a matter of fact, we operate "on a higher level" by simply using ProtectedData.Protect method of CryptoAPI to encrypt those credentials, so we don't have to deal with CSP, algorithm and key length. Not sure what Microsoft uses under the hood for those, but if it was not strong encryption - then CryptoAPI would not be FIPS-certified :D

bolnetworks
Influencer
Posts: 13
Liked: never
Joined: Aug 03, 2010 11:39 am
Full Name: Bol Networks
Contact:

Re: Recover ESXi password in Veeam

Post by bolnetworks » Jan 12, 2018 1:52 pm

We have the same issue. Can you recover the password for us also? I've contacted support and they told me to write a reply in this topic.

veremin
Product Manager
Posts: 17063
Liked: 1474 times
Joined: Oct 26, 2012 3:28 pm
Full Name: Vladimir Eremin
Contact:

Re: Recover ESXi password in Veeam

Post by veremin » Jan 13, 2018 1:36 pm

It's support team that performs password recovery, not the team behind these forums. You might refer to the previously reported ticket 02067079 or escalate the ticket to the higher tier. Thanks.

mcz
Expert
Posts: 308
Liked: 58 times
Joined: Jul 19, 2016 8:39 am
Full Name: Michael
Contact:

Re: Recover ESXi password in Veeam

Post by mcz » Jan 16, 2018 7:45 am

Gostev wrote:As a matter of fact, we operate "on a higher level" by simply using ProtectedData.Protect method of CryptoAPI to encrypt those credentials
+1 for sharing used API's with us

vveeaamm
Lurker
Posts: 1
Liked: 2 times
Joined: Mar 22, 2019 10:04 am
Full Name: ESX

Re: Recover ESXi password in Veeam

Post by vveeaamm » Mar 22, 2019 10:06 am 2 people like this post

Here is a quick .NET code to recover the pass:

Code: Select all

using System;
using System.Collections.Generic;
using System.Security.Cryptography;
using System.Text;

namespace Main 
{
internal static class Program
	{
	private static void Main(string[] args)
		{
			string encrypted = "<pass_from_dbo.Credentials>";
			if (string.IsNullOrEmpty(encrypted))
			{
				return;
			}
			byte[] encryptedData = Convert.FromBase64String(encrypted);
			Console.WriteLine(Encoding.UTF8.GetString(ProtectedData.Unprotect(encryptedData, null, DataProtectionScope.LocalMachine)));
		}
}
}

ialvarez
Lurker
Posts: 1
Liked: never
Joined: May 30, 2019 9:41 pm
Full Name: Isaac Alvarez
Contact:

Re: Recover ESXi password in Veeam

Post by ialvarez » May 30, 2019 9:45 pm

Connect to sql management studio and to the db for veeam

Run this query.

SELECT TOP (1000) [id]
,[user_name]
,[password]
,[usn]
,[description]
,[visible]
,[change_time_utc]
FROM [VeeamBackup].[dbo].[Credentials]

Get the password hash from the results (match the description to the one you need) then run this in powershell on the server running the db/veeam service the BR server with the hash you grabbed.

Add-Type -Path "C:\Program Files\Veeam\Backup and Replication\Backup\Veeam.Backup.Common.dll"
$encoded = 'hashed string from above'
[Veeam.Backup.Common.ProtectedStorage]::GetLocalString($encoded)

vcocaud
Service Provider
Posts: 2
Liked: never
Joined: Sep 03, 2013 4:50 pm
Full Name: Valentin COCAUD
Contact:

Re: Recover ESXi password in Veeam

Post by vcocaud » Jun 12, 2019 3:06 pm

I tried to use ialvarez method but getting this error (english translation = "invalid data") :

Code: Select all

[i]PS C:\Users\Administrateur> [Veeam.Backup.Common.ProtectedStorage]::GetLocalString($encoded)
Exception lors de l'appel de « GetLocalString » avec « 1 » argument(s) : « Données non valides.
 »
Au caractère Ligne:1 : 1
+ [Veeam.Backup.Common.ProtectedStorage]::GetLocalString($encoded)
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : CryptographicException
[/i]
I'm trying to recover a backup encryption password, is it possible with this method or another one ?

mcz
Expert
Posts: 308
Liked: 58 times
Joined: Jul 19, 2016 8:39 am
Full Name: Michael
Contact:

Re: Recover ESXi password in Veeam

Post by mcz » Jun 18, 2019 8:11 am

can you share a screenshot with us?

Post Reply

Who is online

Users browsing this forum: Bing [Bot], hoon0715 and 22 guests