quassel-credentials extract

security/quassel-credentials/README.md

@@ -0,0 +1,57 @@
+# Recover NickServ credentials from a Quassel database
+
+A C++17 command-line utility for the SQLite schema used by Quassel 0.14.0.
+It takes one argument: the path to the database. The database is opened with
+`SQLITE_OPEN_READONLY`; the utility neither creates a missing database nor modifies stored data.
+
+## Build and run
+
+Dependencies on Debian/Ubuntu: `build-essential libsqlite3-dev`.
+
+From the `restore` directory:
+
+```sh
+make
+./restore-nickserv "$HOME/.config/quassel-irc.org/quassel-storage.sqlite"
+```
+
+Alternatively, build without make:
+
+```sh
+g++ -std=c++17 -O2 -Wall -Wextra -Wpedantic main.cpp -lsqlite3 -o restore-nickserv
+```
+
+The database path may differ, for example if Quassel uses `--configdir`.
+For a straightforward recovery, close Quassel before reading the database.
+If working with a copy, copy the database after Quassel has shut down normally:
+while SQLite is running, the latest data may be in the adjacent `-wal` file.
+
+## Output
+
+- All networks belonging to all core users, even when auto-identification is disabled.
+- The NickServ service and saved password (`autoidentifyservice`, `autoidentifypassword`).
+- The associated identity, real name, ident, and all configured nicknames in order.
+- Server addresses, ports, and TLS settings.
+- The SASL account and password: an alternative way to authenticate to an IRC account.
+- Connect, attach, and detach commands, which may also contain an `IDENTIFY` command.
+
+Quassel does not store a separate NickServ account name in its auto-identification
+settings: the code sends `<service> IDENTIFY <password>`. Nicknames are therefore
+listed separately; they are not guaranteed to match the registered account name.
+
+Strings are enclosed in quotes. `NULL` means no value is stored; `""` means an empty
+string. Newlines, tabs, quotes, and backslashes are escaped as `\n`, `\t`, `\"`,
+and `\\`; other control characters are escaped as `\xHH`.
+Escaping is only used for display and is not part of the password.
+
+The output contains passwords in plain text. To save it to a file accessible only
+to its owner:
+
+```sh
+(umask 077; ./restore-nickserv /path/to/quassel-storage.sqlite > recovered.txt)
+```
+
+The utility extracts saved values but does not check whether they are still valid
+on the IRC server. If a password was never saved, it cannot be recovered from this database.
+Exit codes: `0` for success, `1` for a read/output error or an incompatible schema,
+and `2` for an incorrect number of arguments.