in your module file, you will find the fucntion
public function getClientAddFields($package, $vars = null)
add the fallowing code
$user_name = $fields->label('Enter Username', 'username');
$user_name->attach(
$fields->fieldText(
'username',
$this->Html->ifSet($vars->username),
['id' => 'username']
)
);
// Set the label as a field
$fields->setField($user_name);
for blesta password, you can't get the password, if you can got it, then you can send a exploit CVS to blesta