password storage

[anti]

I've only recently become aware of how dangerous it is to let software store ftp passwords for you.
Apparently almost no ftp clients encrypt this info, and just leave it lying around in plain text files.
There are viruses/malware in the wild which can look for and grab these files, and send them to
a recipient in a nanosecond.

I have a VPS, and I use SFTP to connect to my sites with webuilder, which makes the connection secure (I hope).
But can anyone tell me if the storage of saved/remembered passwords is encrypted?
Or should I be using something like KeePass to store all the account info, instead of within webbuilder itself?

Thanks.

bonus question -
When I connect to a cpanel account using SFTP and the account's main user, this user can navigate above the /home folder and into the very root of the cpanel account. That seems like very strange default behaviour! At the moment, it's ok because they're my personal accounts. But if I give some cpanel accounts to other people, how would I keep them in their home folder? Do I need to use openSSH, chrooting and 'jailing', or is their an easier way to make /home/[username] their root directory?

[Gatis]

Hi,

Password is kept encrypted inside Windows Registry. So, it is not very likely someone will be able to steal it from there and then decrypt it.

When I connect to a cpanel account using SFTP and the account's main user, this user can navigate above the /home folder and into the very root of the cpanel account. That seems like very strange default behaviour! At the moment, it's ok because they're my personal accounts. But if I give some cpanel accounts to other people, how would I keep them in their home folder? Do I need to use openSSH, chrooting and 'jailing', or is their an easier way to make /home/[username] their root directory?

I am not sure about this, but I think the problem might be connected to the configuration of your FTP settings on your FTP server. There must be some protection against unwanted access. Otherwise it would be very easy to acess things one should not be able to.

Gatis

[anti]

> Password is kept encrypted inside Windows Registry. So, it is not very likely someone
> will be able to steal it from there and then decrypt it.

That's great to know. FireFTP/Firefox, Filezilla and most others simply keep the login
details in an unencrypted plain text file. I'm having to use KeePass with those programs.

> I think the problem might be connected to the configuration of your FTP settings on your FTP server

FTP is provided by WHM/Cpanel, and works as desired.
As far as I know, SFTP uses SSH and doesn't use the FTP server settings. But I can't see where to easily
set-up the home directory without going through all the headache of chrooting/jailing specific users.
I'll do some more research into it.

Thanks.