PasswordSender is a simple FastCGI web app to put behind Apache or Nginx (although Nginx support, which fastcgi params it sends, is untested. See below), which allows you to send passwords (or other secrets) and files securely. The secret text is stored only in RAM on the server, and any files are stored encrypted on disk. The AES encryption key is also only stored in RAM. That means that restarting the service loses any unopened secrets, but that's the price you pay.
The secrets expire after a few days, or after an hour after opening it and then only by the IP address that originally opened it.
It's provided as is, and was conceived of mostly for the fun of making a C++ web app.
Building is easy. PasswordSender was developed using Qt 5.9.5, Vmime 0.9.2 and openssl 1.1. The Qt version was merely chosen because the development server was Ubuntu 18.04. Building using Ubuntu 24.04 using newer versions of these libraries still works.
When developing or building, it's recommended to use the development packages of the required libraries provided by the Linux distribution. In QtCreator, you can make a 'kit' of the default system compiler and Qt library, versus using a kit based on a Qt version provided by the Qt development installer. One reason is that the Qt versions provided by the development installer are often linked to different versions of OpenSSL than the ones provided by the distribution.
When using Ubuntu to build, you need:
- build-essential (or perhaps only g++ and a few assorted tools)
- libvmime-dev
- qtbase5-dev
- qtbase5-dev-tools
- cmake
To build:
mkdir /tmp/build-PasswordSender
cd /tmp/build-PasswordSender
cmake /path/to/source
make -j "$(nproc)"
You can use any launch manager (SystemD, Supervisor, etc) to start it like this:
/path/to/PasswordSender --listen-port 8000 --template-dir /var/www/html/password_sender --from "Secret Santa <noreply@example.com>" --subject "You received a password"
The --template-dir should point to the files in the docroot of the project.
Example Apache config:
<VirtualHost *:443>
RewriteEngine on
ServerName passwords.foobar.com
SSLEngine on
SSLCertificateFile /bla/cert.pem
SSLCertificateKeyFile /bla/privkey.pem
SSLCertificateChainFile /bla/chain.pem
SetEnvIf Remote_Addr "(.*)" REMOTE_ADDR=$1
ProxyPass "/passwordsender/" "fcgi://localhost:8000/"
DocumentRoot /var/www/html/password_sender
ErrorLog ${APACHE_LOG_DIR}/passwords.foobar.com/error.log
CustomLog ${APACHE_LOG_DIR}/passwords.foobar.com/access.log combined
</VirtualHost>
Nginx sends different FastCGI parameters. The code was made to work with both, but at this point, untested.