rclone/passwordcheck안전하지 않은 비밀번호가 있는지 rclone 설정 파일을 확인합니다.
https://github.com/rclone/rclone/issues/4783 에서 보안 문제가 발견되었는데, "rclone config"로 생성된 비밀번호가 안전하지 않을 수 있다는 내용이었습니다.
이 프로그램은 rclone 구성 파일에서 해당 비밀번호들을 검사합니다.
해당 OS 및 아키텍처에 맞는 zip 파일을 여기에서 다운로드하세요:
zip 아카이브의 압축을 풉니다 - Linux/macOS에서는 unzip archive.zip을 사용하고, Windows에서는 탐색기를 사용합니다.
터미널을 열고 zip 파일의 압축을 푼 위치로 디렉터리를 변경합니다.
먼저 rclone 구성 파일이 어디에 있는지 확인합니다.
rclone config file
Configuration file is stored at:
/home/USER/.rclone.conf
이제 이 경로를 인자로 사용하여 유틸리티를 실행합니다.
./passwordcheck /home/USER/.rclone.conf
실행하는 데 10분 이상 걸릴 수 있습니다. 마지막에는 발견된 안전하지 않은 비밀번호를 보여주는 보고서가 출력됩니다.
예를 들어:
$ ./passwordcheck ~/.rclone.conf
2020/11/19 14:01:49 found 269 remote definitions
2020/11/19 14:01:49 found 54 passwords generated by rclone config which need checking
2020/11/19 14:01:49 ignored 11 passwords not generated by rclone config
2020/11/19 14:01:49 ignored 14 passwords less than 64 bits
2020/11/19 14:01:49 Looking through 39103309 seeds from seed 1566691200 generated at 2019-08-25 01:00:00 to seed 1605794509 generated at 2020-11-19 14:01:49 for 3 passwords of length 64 bits
2020/11/19 14:03:38 FOUND match for remote test-remote-1: obscured password "fJKeinHaUgkd_4pO0J70tUMUkvoxoPES5p7-" at seed 1605788442 generated at 2020-11-19 12:20:42
2020/11/19 14:03:38 That took 1m48.992723504s for 358769.904475 seeds/s
2020/11/19 14:03:38 Looking through 39103309 seeds from seed 1566691200 generated at 2019-08-25 01:00:00 to seed 1605794509 generated at 2020-11-19 14:01:49 for 1 passwords of length 80 bits
2020/11/19 14:05:26 That took 1m48.506673926s for 360376.994199 seeds/s
2020/11/19 14:05:26 Looking through 39103309 seeds from seed 1566691200 generated at 2019-08-25 01:00:00 to seed 1605794509 generated at 2020-11-19 14:01:49 for 3 passwords of length 88 bits
2020/11/19 14:07:15 That took 1m48.705563639s for 359717.641775 seeds/s
2020/11/19 14:07:15 Looking through 39103309 seeds from seed 1566691200 generated at 2019-08-25 01:00:00 to seed 1605794509 generated at 2020-11-19 14:01:49 for 5 passwords of length 96 bits
2020/11/19 14:09:04 That took 1m48.960218306s for 358876.933324 seeds/s
2020/11/19 14:09:04 Looking through 39103309 seeds from seed 1566691200 generated at 2019-08-25 01:00:00 to seed 1605794509 generated at 2020-11-19 14:01:49 for 3 passwords of length 104 bits
2020/11/19 14:10:52 That took 1m48.214117167s for 361351.273047 seeds/s
2020/11/19 14:10:52 Looking through 39103309 seeds from seed 1566691200 generated at 2019-08-25 01:00:00 to seed 1605794509 generated at 2020-11-19 14:01:49 for 5 passwords of length 112 bits
2020/11/19 14:12:40 That took 1m48.342694733s for 360922.433177 seeds/s
2020/11/19 14:12:40 Looking through 39103309 seeds from seed 1566691200 generated at 2019-08-25 01:00:00 to seed 1605794509 generated at 2020-11-19 14:01:49 for 21 passwords of length 128 bits
2020/11/19 14:14:31 FOUND match for remote test-remote-2: obscured password "r-zxEh10ufF9r48najyPn9UrmECuMhWTkIsEubDKtZ3fehFHMwY" at seed 1605793125 generated at 2020-11-19 13:38:45
2020/11/19 14:14:31 FOUND match for remote test-remote-3: obscured password "px0py_poF8Jzis0rxNGf2OvtVZPnmwUruqI1o3trhE1I8fcR3To" at seed 1605793170 generated at 2020-11-19 13:39:30
2020/11/19 14:14:31 That took 1m50.446349362s for 354047.999104 seeds/s
2020/11/19 14:14:31 Looking through 39103309 seeds from seed 1566691200 generated at 2019-08-25 01:00:00 to seed 1605794509 generated at 2020-11-19 14:01:49 for 1 passwords of length 144 bits
2020/11/19 14:16:19 That took 1m47.826663577s for 362649.716710 seeds/s
2020/11/19 14:16:19 Looking through 39103309 seeds from seed 1566691200 generated at 2019-08-25 01:00:00 to seed 1605794509 generated at 2020-11-19 14:01:49 for 12 passwords of length 1024 bits
2020/11/19 14:18:10 That took 1m51.525192167s for 350623.103536 seeds/s
*** 3 Insecure passwords found
remote test-remote-1: "fJKeinHaUgkd_4pO0J70tUMUkvoxoPES5p7-"
remote test-remote-2: "r-zxEh10ufF9r48najyPn9UrmECuMhWTkIsEubDKtZ3fehFHMwY"
remote test-remote-3: "px0py_poF8Jzis0rxNGf2OvtVZPnmwUruqI1o3trhE1I8fcR3To"
참고 rclone이 출력하는 난독화된 비밀번호를 공개하지 마세요. 이 비밀번호는 실제 비밀번호로 쉽게 역산될 수 있습니다. 여기 표시된 것들은 데모 목적입니다.
더 자세한 내용을 보려면 -verbose 플래그를 사용하여 실행하세요.