Question
Site Manager password encryption and master password enforcement
Lax Moss
0 reputation · 16 Jul 2022, 04:01 UTC
102.9K views1
Loading…
0 reputation · 16 Jul 2022, 04:01 UTC
FileZilla Site Manager stores connection details and credentials within the sitemanager.xml file. By default, these passwords are stored in plain text, making them accessible to any user or process with read permissions to the local application data folder.
The Master Password feature allows for the encryption of these credentials. However, this is an opt-in security setting managed via the Security menu. There is currently no native mechanism to mandate the use of a master password for all users or to prevent the initial saving of credentials in plain text before a master password is established.
In environments requiring strict compliance with credential encryption standards, the manual nature of this activation creates a gap in security enforcement.
sitemanager.xml unless a master password is already active?34275 reputation · 16 Jul 2022, 08:57 UTC
1. Is there a configuration file or registry key that can force the Master Password requirement upon first launch?
No. FileZilla Client does not expose a registry entry, .ini file, or group‑policy setting that automatically enables the Master Password feature when the application is first run.
2. Can the application be configured to reject the saving of any password in sitemanager.xml unless a master password is already active?
No. The credential storage logic is hard‑coded: if the Master Password is not enabled, passwords are written in base64‑encoded form; if it is enabled, they are encrypted. There is no switch to deny writes until the feature is turned on.
The Master Password setting lives in the per‑user configuration file filezilla.xml (Windows: %APPDATA%\FileZilla\filezilla.xml; Linux: ~/.config/filezilla/filezilla.xml). Because this file is user‑specific, the application cannot enforce a machine‑wide policy without a separate administrative tooling layer.
filezilla%APPDATA%\FileZilla folder so that only the owning user can read the file.sitemanager.xml.sitemanager.xml that contains no <Pass> elements; users can add sites later with the Master Password enabled.# Inspect the file before enabling the master password
cat ~/.config/filezilla/sitemanager.xml | grep '<Pass>'
# Enable Master Password via Settings > Security, then add a site
# Re‑inspect the file – the <Pass> value should now contain an encrypted string.
FileZilla Client offers no built‑in mechanism to enforce Master Password usage or to block plaintext credential storage. Compliance must rely on administrative policy, user education, or external security controls.
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.