Documentation
¶
Overview ¶
Package rcloneconfig extracts cloud-remote credentials from an rclone configuration file (rclone.conf).
rclone is the ubiquitous "rsync for cloud storage" tool, and its config is common loot on a backup / sync / CI host: each [remote] section holds the credentials for an S3 bucket, a Google Drive, an SFTP server, a WebDAV share, and so on. The high-value, uniquely recoverable part is rclone's "obscured" passwords: rclone does not store these in plaintext, but it does not encrypt them with a user secret either — it "obscures" them with AES-256-CTR under a single hardcoded key (rclone fs/config/obscure/obscure.go), explicitly NOT a security measure (per rclone's own docs). They are therefore fully reversible offline. This reveals them, and surfaces the plaintext secrets (S3 keys, OAuth tokens) the config holds verbatim.
No confidently-wrong output: a password field is revealed only when its value is a valid rclone-obscure blob (RawURL-base64 of IV+ciphertext, ≥ one AES block) that decodes to printable UTF-8; a value that does not decode, or decodes to non-printable bytes, is reported as plaintext / unrevealable with the raw value surfaced — never a garbage "password". Input that is not an rclone config (no [section] with config keys) is rejected.
Wrap-vs-native: native — an INI scanner plus the exact rclone Reveal transform (crypto/aes + crypto/cipher, stdlib only, no new go.mod dependency). The key and algorithm are taken verbatim from rclone fs/config/obscure/obscure.go and anchored to rclone's own published reveal vectors (see the package test).
Index ¶
Constants ¶
const ( // KindRevealedPassword is an rclone-obscured password successfully revealed // to printable plaintext (the operator can use it directly). KindRevealedPassword = "revealed-password" // KindPlaintextSecret is a field stored in the clear in the config (S3 keys, // OAuth tokens, …) or a password field that is not actually obscured. KindPlaintextSecret = "plaintext-secret" // KindObscuredUnrevealable is a known password field whose value decodes to // non-printable bytes — surfaced raw, with no plaintext claimed. KindObscuredUnrevealable = "obscured-unrevealable" )
Kind classifies a recovered credential field.
Variables ¶
This section is empty.
Functions ¶
func Reveal ¶
Reveal reverses rclone's Obscure: it RawURL-base64-decodes the input into a 16-byte IV followed by AES-256-CTR ciphertext, then decrypts under the hardcoded key. It mirrors rclone's obscure.Reveal exactly, including the "input too short" guard. It does not judge whether the plaintext is sensible (that is the caller's job) — only that the structure is a valid obscure blob.
Types ¶
type Cred ¶
type Cred struct {
Field string `json:"field"`
Kind string `json:"kind"`
// Value is the usable credential: the revealed plaintext for a
// revealed-password, or the verbatim value for a plaintext-secret. Empty for
// an obscured-unrevealable field (see Obscured).
Value string `json:"value,omitempty"`
// Obscured is the raw rclone-obscure blob, set when the field is an obscured
// password (whether or not the reveal produced printable plaintext).
Obscured string `json:"obscured,omitempty"`
Note string `json:"note,omitempty"`
}
Cred is one recovered credential from a remote.
type Remote ¶
type Remote struct {
Name string `json:"name"`
Type string `json:"type,omitempty"`
Credentials []Cred `json:"credentials,omitempty"`
}
Remote is one [section] of the rclone config.
Source Files