How to retrieve remote FTP backup file list via API (password hidden)

[amoozesh98com]

Hey everyone,

I'm developing a WHMCS module for our DirectAdmin servers and I've hit a wall. The goal is to let our users see what backup files are available on the remote FTP server (the one configured in Admin Backup/Reseller Backup) so they can request a specific restore date via a support ticket.

Everything works fine for local backups – I can get the settings via CMD_API_ADMIN_BACKUP?json=yes and even list the files. But for remote FTP backups, the API returns all the FTP connection details except the actual password. It just shows XXXXXXXXXX or an empty string for ftp_password. I've tried:

• CMD_API_ADMIN_BACKUP (raw & JSON) – password masked.
• CMD_API_ADMIN_BACKUP_MODIFY?cron=2 – same.
• CMD_API_USER_BACKUP and CMD_API_SITE_BACKUP – either empty password or "You do not own that domain".
• Logging in with a session cookie and parsing the HTML of the backup page – the password field is still XXXXXXXXXX and obviously the browser just shows dots.
• Task queue, cron jobs API – no password there either.
• Even trying to read the config files via the file editor API (CMD_API_FILE_EDITOR) just redirects to the login page.

I understand this is a security measure – you shouldn't be able to pull plaintext passwords via the API. But is there any official way to list the contents of the remote FTP backup directory without knowing the password? Something like an API call that uses the stored credentials internally and returns the file list? Or maybe a hook/script that runs on the server and can be triggered via API?

I'm running the latest Evolution skin, and the backup cron is working perfectly (I can see the backup progress and files in the DA panel). I just need a way to expose that file list to my module so users can pick a backup date for restore.

Any pointers would be greatly appreciated. If there's truly no way, I'll just have to ask the admin to manually enter the FTP password into a custom field, but that's not ideal.

Thanks in advance!

 

[sysdev]

Well, it's not very smart to have an api return passwords.

How about just registering the backups locally using a web hook like all_backups_post.sh? Use it to update e.g. a backups.json in the user directory. If you need a users backups meta data, just retrieve that file using the api.

 

[amoozesh98com]

I need to provide our WHMCS users with a list of available backup files stored on a remote FTP server (configured via Admin Backup in DirectAdmin), including file names, creation dates, and sizes. The goal is to let users pick a specific backup date when requesting a restore via support ticket.

The problem: DirectAdmin API (CMD_API_ADMIN_BACKUP?json=yes) masks the FTP password (shows XXXXXXXXXX), so I can't connect to the FTP server to list files.

I understand that exposing plaintext passwords via API is a security risk. So I'm looking for a secure, recommended approach:

1. Can I use all_backups_post.sh hook (which receives ftp_password, ftp_ip, ftp_path, etc. as environment variables) to generate a metadata file (e.g., backups.json) in /home/admin/ after each backup, containing file names, sizes, and timestamps?
2. Then read that JSON file via CMD_API_EXEC or CMD_API_FILE_EDITOR from WHMCS?
3. Is there a built-in API endpoint that returns the list of files already stored on the remote FTP, using the stored credentials internally without exposing them?

I'm running DirectAdmin v1.689+ with Evolution skin. The backup cron is working perfectly – I just need to expose the file list to my module securely.

Any guidance on the best practice for this scenario would be greatly appreciated.

 

[sysdev]

1 + 2 yes.
3. somewhat... not an api endpoint (i think) but you can make that list easily.

DA doesn't need to export the password as it's already available in that hook. It runs after alle backups have run and you can do whatever you want there:

You can e.g. do something like this to get a list of files from the same backup server:

#!/bin/bash

output=/home/admin/backups.json
tmp=$(mktemp)

# use a mini ftp script to get the remote directory listing
lftp -u "$ftp_username","$ftp_password" \
    -p "${ftp_port:-21}" "$ftp_ip" <<EOF >"$tmp"
set cmd:fail-exit yes
set ftp:ssl-force no
cd "$ftp_path"
cls -l --time-style=long-iso
bye
EOF

# make a function to format that list in any way you want
my_own_generate_json_from_listing "$tmp" >"${output}.new" && mv "${output}.new" "$output"

rm -f "$tmp"

next, have whmcs retrieve it, of upload the file yourself to the whmcs.

Edit: this is a very basic example. Don't put passwords on the lftp commandline as it is visible in the processlist. Use a lftp config file.