qssh 0.4.3

Post-quantum secure shell with NIST PQC algorithms (Falcon, SPHINCS+, ML-KEM), configurable security tiers, and quantum-resistant protocol design
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111

//! QSSH Password Management Tool

use clap::Parser;
use qssh::auth::PasswordAuthManager;
use std::path::PathBuf;
use zeroize::Zeroize;

#[derive(Parser, Debug)]
#[clap(name = "qssh-passwd")]
#[clap(about = "Manage QSSH user passwords")]
struct Args {
    /// Username to set password for
    username: String,

    /// Password file path (default: /etc/qssh/passwords)
    #[clap(short = 'f', long)]
    file: Option<String>,

    /// Delete user password
    #[clap(short = 'd', long)]
    delete: bool,

    /// Check if user exists
    #[clap(short = 'c', long)]
    check: bool,
}

#[tokio::main]
async fn main() {
    let args = Args::parse();

    let password_file = args.file
        .unwrap_or_else(|| "/etc/qssh/passwords".to_string());

    let manager = PasswordAuthManager::new(PathBuf::from(&password_file));

    // Load existing passwords
    if let Err(e) = manager.load_passwords().await {
        eprintln!("Warning: Failed to load existing passwords: {}", e);
    }

    if args.check {
        // Check if user has a password set
        eprint!("Enter password to verify: ");
        let mut password = rpassword::read_password().unwrap();

        let result = manager.verify_password(&args.username, &password).await;
        password.zeroize();

        match result {
            Ok(true) => {
                println!("Password correct for user {}", args.username);
                std::process::exit(0);
            }
            Ok(false) => {
                println!("Invalid password or user not found");
                std::process::exit(1);
            }
            Err(e) => {
                eprintln!("Error verifying password: {}", e);
                std::process::exit(2);
            }
        }
    } else if args.delete {
        // Delete user password by setting empty entry
        match manager.set_password(&args.username, "").await {
            Ok(()) => {
                println!("Password deleted for user {}", args.username);
            }
            Err(e) => {
                eprintln!("Failed to delete password: {}", e);
                std::process::exit(1);
            }
        }
    } else {
        // Set password for user
        eprint!("Enter new password for {}: ", args.username);
        let mut password = rpassword::read_password().unwrap();

        eprint!("Confirm password: ");
        let mut confirm = rpassword::read_password().unwrap();

        if password != confirm {
            password.zeroize();
            confirm.zeroize();
            eprintln!("Passwords do not match");
            std::process::exit(1);
        }
        confirm.zeroize();

        if password.is_empty() {
            eprintln!("Password cannot be empty");
            std::process::exit(1);
        }

        // Set the password
        let result = manager.set_password(&args.username, &password).await;
        password.zeroize();

        match result {
            Ok(()) => {
                println!("Password set for user {}", args.username);
                println!("Password file: {}", password_file);
            }
            Err(e) => {
                eprintln!("Failed to set password: {}", e);
                std::process::exit(1);
            }
        }
    }
}