Restic password criteria

Support
1

NethServer Version: 7.9
Module: backup

Hi all
a friend of mine suffered a HW crash and has the backup on a S3 instance, done with restic
unfortunately… he hasn’t the correct restic pwd
can anyone tell me the criteria behind restic password generation?
AFAICT it’s always 16 chars long… am I right?
any other criteria about special chars/repetition and so on?
I’m trying to generate a password list to feed john the ripper and have the password back
TIA

2

@giacomo

3

Ehi Stefano, welcome back.

Did you take a look at this?

4

Hi Alessio

Yes, I read it.
Unfortunately, as I said, I don’t have the restic password autogenerated.
So I have my full backup available but I can’t decrypt it and restore it
I’m asking about how the restica password is generated to try to generate a wordlist to be used with John the ripper to “crack” the key sha265 hash.
As you maybe know I’m not a Neth user, I’m just trying to help a friend and I sincerely have no time to search the source code.
in any case, thank you for your time

5

ok… according to this page (nethserver-lib/lib/perl/NethServer/Password.pm at 59cdfcf372eb2d49f010e97bf97bcba107b1b0fa · NethServer/nethserver-lib · GitHub) password are generated with this routine

sub generate
{
    my $self = shift;
    my @symbols = (); # flat alphabet set

    my $length = $self->{'length'};
    my @secret = ();
    my @keyset = 0..($length - 1);

    # Flattenize the alphabet and extract a symbol from each sublist
    foreach (@{$self->{'symbols'}}) {
        if(ref $_ eq 'ARRAY') {
            my @psym = @{$_};
            my $index = $keyset[rand(@keyset)]; # get a random index
            @keyset = grep { $_ != $index } @keyset; # pop the extracted index from the set
            $secret[$index] = $psym[rand(@psym)]; # initialize the index with a random sublist element
            push @symbols, @psym; # flattenize the sublist
        } else {
            push @symbols, $_;
        }
    }

    foreach (@keyset) {
        $secret[$_] = $symbols[rand(@symbols)]; # fill the remaining indexes
    }

    $self->{'secret'} = join('', @secret);

    $self->{'dirty'} = 1;
    return $self;
}

where simbols are:
‘symbols’ => [[‘A’…‘Z’], [‘a’…‘z’], [‘0’…‘9’], [‘_’]]

I’m not a perl expert, would anyone mind to explain the routine?
thank you

6

The password is 16 chars long, the symbol list is limited to 63 different chars.
It means 63^16 possible passwords.
John will be useless.

1 Like
7

Thank you

8

I believe that password is stored on the config backup if you’ve it somewhere.

9

as in ‘config show’ ?

I remember me having a cron job with “config show → [date]config.backup” every 24 hours