rclone config redacted: implement support mechanism for showing redacted config

This introduces a new fs.Option flag, Sensitive and uses this along
with IsPassword to redact the info in the config file for support
purposes.

It adds this flag into backends where appropriate. It was necessary to
add oauthutil.SharedOptions to some backends as they were missing
them.

Fixes #5209

backend/azureblob/azureblob.go

@@ -95,6 +95,7 @@ Leave blank to use SAS URL or Emulator, otherwise it needs to be set.
 If this is blank and if env_auth is set it will be read from the
 environment variable ` + "`AZURE_STORAGE_ACCOUNT_NAME`" + ` if possible.
 `,
+			Sensitive: true,
 		}, {
 			Name: "env_auth",
 			Help: `Read credentials from runtime (environment variables, CLI or MSI).
@@ -106,11 +107,13 @@ See the [authentication docs](/azureblob#authentication) for full info.`,
 			Help: `Storage Account Shared Key.
 
 Leave blank to use SAS URL or Emulator.`,
+			Sensitive: true,
 		}, {
 			Name: "sas_url",
 			Help: `SAS URL for container level access only.
 
 Leave blank if using account/key or Emulator.`,
+			Sensitive: true,
 		}, {
 			Name: "tenant",
 			Help: `ID of the service principal's tenant. Also called its directory ID.
@@ -120,6 +123,7 @@ Set this if using
 - Service principal with certificate
 - User with username and password
 `,
+			Sensitive: true,
 		}, {
 			Name: "client_id",
 			Help: `The ID of the client in use.
@@ -129,6 +133,7 @@ Set this if using
 - Service principal with certificate
 - User with username and password
 `,
+			Sensitive: true,
 		}, {
 			Name: "client_secret",
 			Help: `One of the service principal's client secrets
@@ -136,6 +141,7 @@ Set this if using
 Set this if using
 - Service principal with client secret
 `,
+			Sensitive: true,
 		}, {
 			Name: "client_certificate_path",
 			Help: `Path to a PEM or PKCS12 certificate file including the private key.
@@ -174,6 +180,7 @@ Set this if using
 - User with username and password
 `,
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name: "password",
 			Help: `The user's password
@@ -219,14 +226,17 @@ msi_client_id, or msi_mi_res_id parameters.`,
 			Name:      "msi_object_id",
 			Help:      "Object ID of the user-assigned MSI to use, if any.\n\nLeave blank if msi_client_id or msi_mi_res_id specified.",
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name:      "msi_client_id",
 			Help:      "Object ID of the user-assigned MSI to use, if any.\n\nLeave blank if msi_object_id or msi_mi_res_id specified.",
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name:      "msi_mi_res_id",
 			Help:      "Azure resource ID of the user-assigned MSI to use, if any.\n\nLeave blank if msi_client_id or msi_object_id specified.",
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name:     "use_emulator",
 			Help:     "Uses local storage emulator if provided as 'true'.\n\nLeave blank if using real azure storage endpoint.",

backend/b2/b2.go

@@ -78,10 +78,12 @@ func init() {
 			Name:      "account",
 			Help:      "Account ID or Application Key ID.",
 			Required:  true,
+			Sensitive: true,
 		}, {
 			Name:      "key",
 			Help:      "Application Key.",
 			Required:  true,
+			Sensitive: true,
 		}, {
 			Name:     "endpoint",
 			Help:     "Endpoint for the service.\n\nLeave blank normally.",

backend/box/box.go

@@ -111,12 +111,14 @@ func init() {
 			Help:      "Fill in for rclone to use a non root folder as its starting point.",
 			Default:   "0",
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name: "box_config_file",
 			Help: "Box App config.json location\n\nLeave blank normally." + env.ShellExpandHelp,
 		}, {
 			Name:      "access_token",
 			Help:      "Box App Primary Access Token\n\nLeave blank normally.",
+			Sensitive: true,
 		}, {
 			Name:    "box_sub_type",
 			Default: "user",

backend/cache/cache.go

@@ -78,6 +78,7 @@ func init() {
 		}, {
 			Name:      "plex_username",
 			Help:      "The username of the Plex user.",
+			Sensitive: true,
 		}, {
 			Name:       "plex_password",
 			Help:       "The password of the Plex user.",
@@ -87,6 +88,7 @@ func init() {
 			Help:      "The plex token for authentication - auto set normally.",
 			Hide:      fs.OptionHideBoth,
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name:     "plex_insecure",
 			Help:     "Skip all certificate verification when connecting to the Plex server.",

backend/drive/drive.go

@@ -278,6 +278,7 @@ Fill in to access "Computers" folders (see docs), or for rclone to use
 a non root folder as its starting point.
 `,
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name: "service_account_file",
 			Help: "Service Account Credentials JSON file path.\n\nLeave blank normally.\nNeeded only if you want use SA instead of interactive login." + env.ShellExpandHelp,
@@ -286,11 +287,13 @@ a non root folder as its starting point.
 			Help:      "Service Account Credentials JSON blob.\n\nLeave blank normally.\nNeeded only if you want use SA instead of interactive login.",
 			Hide:      fs.OptionHideConfigurator,
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name:      "team_drive",
 			Help:      "ID of the Shared Drive (Team Drive).",
 			Hide:      fs.OptionHideConfigurator,
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name:     "auth_owner_only",
 			Default:  false,
@@ -420,6 +423,7 @@ date is used.`,
 			Default:   "",
 			Help:      `Impersonate this user when using a service account.`,
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name:    "alternate_export",
 			Default: false,
@@ -593,6 +597,7 @@ user you've authenticated rclone with) seems to be enough so that the
 resource key is no needed.
 `,
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name:     config.ConfigEncoding,
 			Help:     config.ConfigEncodingHelp,

backend/dropbox/dropbox.go

@@ -184,6 +184,7 @@ v1.55 or later is in use everywhere.
 `,
 			Default:   "",
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name: "shared_files",
 			Help: `Instructs rclone to work on individual shared files.

backend/fichier/fichier.go

@@ -40,6 +40,7 @@ func init() {
 		Options: []fs.Option{{
 			Help:      "Your API Key, get it from https://1fichier.com/console/params.pl.",
 			Name:      "api_key",
+			Sensitive: true,
 		}, {
 			Help:     "If you want to download a shared folder, add this parameter.",
 			Name:     "shared_folder",

backend/filefabric/filefabric.go

@@ -84,6 +84,7 @@ Leave blank normally.
 
 Fill in to make rclone start with directory of a given ID.
 `,
+			Sensitive: true,
 		}, {
 			Name: "permanent_token",
 			Help: `Permanent Authentication Token.
@@ -97,6 +98,7 @@ These tokens are normally valid for several years.
 
 For more info see: https://docs.storagemadeeasy.com/organisationcloud/api-tokens
 `,
+			Sensitive: true,
 		}, {
 			Name: "token",
 			Help: `Session Token.
@@ -107,6 +109,7 @@ usually valid for 1 hour.
 Don't set this value - rclone will set it automatically.
 `,
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name: "token_expiry",
 			Help: `Token expiry time.

backend/ftp/ftp.go

@@ -51,10 +51,12 @@ func init() {
 			Name:      "host",
 			Help:      "FTP host to connect to.\n\nE.g. \"ftp.example.com\".",
 			Required:  true,
+			Sensitive: true,
 		}, {
 			Name:      "user",
 			Help:      "FTP username.",
 			Default:   currentUser,
+			Sensitive: true,
 		}, {
 			Name:    "port",
 			Help:    "FTP port number.",

backend/googlecloudstorage/googlecloudstorage.go

@@ -93,9 +93,11 @@ func init() {
 		Options: append(oauthutil.SharedOptions, []fs.Option{{
 			Name:      "project_number",
 			Help:      "Project number.\n\nOptional - needed only for list/create/delete buckets - see your developer console.",
+			Sensitive: true,
 		}, {
 			Name:      "user_project",
 			Help:      "User project.\n\nOptional - needed only for requester pays.",
+			Sensitive: true,
 		}, {
 			Name: "service_account_file",
 			Help: "Service Account Credentials JSON file path.\n\nLeave blank normally.\nNeeded only if you want use SA instead of interactive login." + env.ShellExpandHelp,
@@ -103,6 +105,7 @@ func init() {
 			Name:      "service_account_credentials",
 			Help:      "Service Account Credentials JSON blob.\n\nLeave blank normally.\nNeeded only if you want use SA instead of interactive login.",
 			Hide:      fs.OptionHideBoth,
+			Sensitive: true,
 		}, {
 			Name:    "anonymous",
 			Help:    "Access public buckets and objects without credentials.\n\nSet to 'true' if you just want to download files and don't configure credentials.",

backend/hdfs/hdfs.go

@@ -22,6 +22,7 @@ func init() {
 			Name:      "namenode",
 			Help:      "Hadoop name node and port.\n\nE.g. \"namenode:8020\" to connect to host namenode at port 8020.",
 			Required:  true,
+			Sensitive: true,
 		}, {
 			Name: "username",
 			Help: "Hadoop user name.",
@@ -29,6 +30,7 @@ func init() {
 				Value: "root",
 				Help:  "Connect to hdfs as root.",
 			}},
+			Sensitive: true,
 		}, {
 			Name: "service_principal_name",
 			Help: `Kerberos service principal name for the namenode.
@@ -37,6 +39,7 @@ Enables KERBEROS authentication. Specifies the Service Principal Name
 (SERVICE/FQDN) for the namenode. E.g. \"hdfs/namenode.hadoop.docker\"
 for namenode running as service 'hdfs' with FQDN 'namenode.hadoop.docker'.`,
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name: "data_transfer_protection",
 			Help: `Kerberos data transfer protection: authentication|integrity|privacy.

backend/internetarchive/internetarchive.go

@@ -135,9 +135,11 @@ Owner is able to add custom keys. Metadata feature grabs all the keys including
 		Options: []fs.Option{{
 			Name:      "access_key_id",
 			Help:      "IAS3 Access Key.\n\nLeave blank for anonymous access.\nYou can find one here: https://archive.org/account/s3.php",
+			Sensitive: true,
 		}, {
 			Name:      "secret_access_key",
 			Help:      "IAS3 Secret Key (password).\n\nLeave blank for anonymous access.",
+			Sensitive: true,
 		}, {
 			// their official client (https://github.com/jjjake/internetarchive) hardcodes following the two
 			Name:     "endpoint",

backend/jottacloud/jottacloud.go

@@ -88,7 +88,7 @@ func init() {
 		Description: "Jottacloud",
 		NewFs:       NewFs,
 		Config:      Config,
-		Options: []fs.Option{{
+		Options: append(oauthutil.SharedOptions, []fs.Option{{
 			Name:     "md5_memory_limit",
 			Help:     "Files bigger than this will be cached on disk to calculate the MD5 if required.",
 			Default:  fs.SizeSuffix(10 * 1024 * 1024),
@@ -123,7 +123,7 @@ func init() {
 			Default: (encoder.Display |
 				encoder.EncodeWin | // :?"*<>|
 				encoder.EncodeInvalidUtf8),
-		}},
+		}}...),
 	})
 }
 

backend/koofr/koofr.go

@@ -64,6 +64,7 @@ func init() {
 			Name:      "user",
 			Help:      "Your user name.",
 			Required:  true,
+			Sensitive: true,
 		}, {
 			Name:       "password",
 			Help:       "Your password for rclone (generate one at https://app.koofr.net/app/admin/preferences/password).",

backend/mailru/mailru.go

@@ -85,10 +85,11 @@ func init() {
 		Name:        "mailru",
 		Description: "Mail.ru Cloud",
 		NewFs:       NewFs,
-		Options: []fs.Option{{
+		Options: append(oauthutil.SharedOptions, []fs.Option{{
 			Name:      "user",
 			Help:      "User name (usually email).",
 			Required:  true,
+			Sensitive: true,
 		}, {
 			Name: "pass",
 			Help: `Password.
@@ -213,7 +214,7 @@ Supported quirks: atomicmkdir binlist unknowndirs`,
 				encoder.EncodeWin | // :?"*<>|
 				encoder.EncodeBackSlash |
 				encoder.EncodeInvalidUtf8),
-		}},
+		}}...),
 	})
 }
 

backend/mega/mega.go

@@ -61,6 +61,7 @@ func init() {
 			Name:      "user",
 			Help:      "User name.",
 			Required:  true,
+			Sensitive: true,
 		}, {
 			Name:       "pass",
 			Help:       "Password.",

backend/netstorage/netstorage.go

@@ -66,10 +66,12 @@ HTTP is provided primarily for debugging purposes.`,
 
 Format should be ` + "`<domain>/<internal folders>`",
 			Required:  true,
+			Sensitive: true,
 		}, {
 			Name:      "account",
 			Help:      "Set the NetStorage account name",
 			Required:  true,
+			Sensitive: true,
 		}, {
 			Name: "secret",
 			Help: `Set the NetStorage account secret/G2O key for authentication.

backend/onedrive/onedrive.go

@@ -135,6 +135,7 @@ Note that the chunks will be buffered into memory.`,
 			Help:      "The ID of the drive to use.",
 			Default:   "",
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name:     "drive_type",
 			Help:     "The type of the drive (" + driveTypePersonal + " | " + driveTypeBusiness + " | " + driveTypeSharepoint + ").",
@@ -149,6 +150,7 @@ know the folder ID that you wish to access but not be able to get
 there through a path traversal.
 `,
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name: "access_scopes",
 			Help: `Set scopes to be requested by rclone.
@@ -261,6 +263,7 @@ this flag there.
 At the time of writing this only works with OneDrive personal paid accounts.
 `,
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name:    "hash_type",
 			Default: "auto",

backend/opendrive/opendrive.go

@@ -45,6 +45,7 @@ func init() {
 			Name:      "username",
 			Help:      "Username.",
 			Required:  true,
+			Sensitive: true,
 		}, {
 			Name:       "password",
 			Help:       "Password.",

backend/oracleobjectstorage/options.go

@@ -95,11 +95,13 @@ func newOptions() []fs.Option {
 		Name:      "namespace",
 		Help:      "Object storage namespace",
 		Required:  true,
+		Sensitive: true,
 	}, {
 		Name:      "compartment",
 		Help:      "Object storage compartment OCID",
 		Provider:  "!no_auth",
 		Required:  true,
+		Sensitive: true,
 	}, {
 		Name:     "region",
 		Help:     "Object storage Region",

backend/pcloud/pcloud.go

@@ -114,6 +114,7 @@ func init() {
 			Help:      "Fill in for rclone to use a non root folder as its starting point.",
 			Default:   "d0",
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name: "hostname",
 			Help: `Hostname to connect to.
@@ -139,6 +140,7 @@ This is only required when you want to use the cleanup command. Due to a bug
 in the pcloud API the required API does not support OAuth authentication so
 we have to rely on user password authentication for it.`,
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name:       "password",
 			Help:       "Your pcloud password.",

backend/pikpak/pikpak.go

@@ -161,6 +161,7 @@ func init() {
 			Name:      "user",
 			Help:      "Pikpak username.",
 			Required:  true,
+			Sensitive: true,
 		}, {
 			Name:       "pass",
 			Help:       "Pikpak password.",
@@ -174,6 +175,7 @@ Leave blank normally.
 Fill in for rclone to use a non root folder as its starting point.
 `,
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name:     "use_trash",
 			Default:  true,

backend/premiumizeme/premiumizeme.go

@@ -82,7 +82,7 @@ func init() {
 				OAuth2Config: oauthConfig,
 			})
 		},
-		Options: []fs.Option{{
+		Options: append(oauthutil.SharedOptions, []fs.Option{{
 			Name: "api_key",
 			Help: `API Key.
 
@@ -90,6 +90,7 @@ This is not normally used - use oauth instead.
 `,
 			Hide:      fs.OptionHideBoth,
 			Default:   "",
+			Sensitive: true,
 		}, {
 			Name:     config.ConfigEncoding,
 			Help:     config.ConfigEncodingHelp,
@@ -99,7 +100,7 @@ This is not normally used - use oauth instead.
 				encoder.EncodeBackSlash |
 				encoder.EncodeDoubleQuote |
 				encoder.EncodeInvalidUtf8),
-		}},
+		}}...),
 	})
 }
 

backend/putio/putio.go

@@ -67,7 +67,7 @@ func init() {
 				NoOffline:    true,
 			})
 		},
-		Options: []fs.Option{{
+		Options: append(oauthutil.SharedOptions, []fs.Option{{
 			Name:     config.ConfigEncoding,
 			Help:     config.ConfigEncodingHelp,
 			Advanced: true,
@@ -77,7 +77,7 @@ func init() {
 			Default: (encoder.Display |
 				encoder.EncodeBackSlash |
 				encoder.EncodeInvalidUtf8),
-		}},
+		}}...),
 	})
 }
 

backend/qingstor/qingstor.go

@@ -51,9 +51,11 @@ func init() {
 		}, {
 			Name:      "access_key_id",
 			Help:      "QingStor Access Key ID.\n\nLeave blank for anonymous access or runtime credentials.",
+			Sensitive: true,
 		}, {
 			Name:      "secret_access_key",
 			Help:      "QingStor Secret Access Key (password).\n\nLeave blank for anonymous access or runtime credentials.",
+			Sensitive: true,
 		}, {
 			Name: "endpoint",
 			Help: "Enter an endpoint URL to connection QingStor API.\n\nLeave blank will use the default value \"https://qingstor.com:443\".",

backend/s3/s3.go

@@ -184,9 +184,11 @@ func init() {
 		}, {
 			Name:      "access_key_id",
 			Help:      "AWS Access Key ID.\n\nLeave blank for anonymous access or runtime credentials.",
+			Sensitive: true,
 		}, {
 			Name:      "secret_access_key",
 			Help:      "AWS Secret Access Key (password).\n\nLeave blank for anonymous access or runtime credentials.",
+			Sensitive: true,
 		}, {
 			// References:
 			// 1. https://docs.aws.amazon.com/general/latest/gr/rande.html
@@ -1818,6 +1820,7 @@ header is added and the default (private) will be used.
 				Value: "arn:aws:kms:us-east-1:*",
 				Help:  "arn:aws:kms:*",
 			}},
+			Sensitive: true,
 		}, {
 			Name: "sse_customer_key",
 			Help: `To use SSE-C you may provide the secret encryption key used to encrypt/decrypt your data.
@@ -1829,6 +1832,7 @@ Alternatively you can provide --sse-customer-key-base64.`,
 				Value: "",
 				Help:  "None",
 			}},
+			Sensitive: true,
 		}, {
 			Name: "sse_customer_key_base64",
 			Help: `If using SSE-C you must provide the secret encryption key encoded in base64 format to encrypt/decrypt your data.
@@ -1840,6 +1844,7 @@ Alternatively you can provide --sse-customer-key.`,
 				Value: "",
 				Help:  "None",
 			}},
+			Sensitive: true,
 		}, {
 			Name: "sse_customer_key_md5",
 			Help: `If using SSE-C you may provide the secret encryption key MD5 checksum (optional).
@@ -1852,6 +1857,7 @@ If you leave it blank, this is calculated automatically from the sse_customer_ke
 				Value: "",
 				Help:  "None",
 			}},
+			Sensitive: true,
 		}, {
 			Name:     "storage_class",
 			Help:     "The storage class to use when storing new objects in S3.",
@@ -2096,6 +2102,7 @@ If empty it will default to the environment variable "AWS_PROFILE" or
 			Name:      "session_token",
 			Help:      "An AWS session token.",
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name: "upload_concurrency",
 			Help: `Concurrency for multipart uploads.

backend/seafile/seafile.go

@@ -67,15 +67,18 @@ func init() {
 				Value: "https://cloud.seafile.com/",
 				Help:  "Connect to cloud.seafile.com.",
 			}},
+			Sensitive: true,
 		}, {
 			Name:      configUser,
 			Help:      "User name (usually email address).",
 			Required:  true,
+			Sensitive: true,
 		}, {
 			// Password is not required, it will be left blank for 2FA
 			Name:       configPassword,
 			Help:       "Password.",
 			IsPassword: true,
+			Sensitive:  true,
 		}, {
 			Name:    config2FA,
 			Help:    "Two-factor authentication ('true' if the account has 2FA enabled).",
@@ -87,6 +90,7 @@ func init() {
 			Name:       configLibraryKey,
 			Help:       "Library password (for encrypted libraries only).\n\nLeave blank if you pass it through the command line.",
 			IsPassword: true,
+			Sensitive:  true,
 		}, {
 			Name:     configCreateLibrary,
 			Help:     "Should rclone create a library if it doesn't exist.",
@@ -97,6 +101,7 @@ func init() {
 			Name:      configAuthToken,
 			Help:      "Authentication token.",
 			Hide:      fs.OptionHideBoth,
+			Sensitive: true,
 		}, {
 			Name:     config.ConfigEncoding,
 			Help:     config.ConfigEncodingHelp,

backend/sftp/sftp.go

@@ -62,10 +62,12 @@ func init() {
 			Name:      "host",
 			Help:      "SSH host to connect to.\n\nE.g. \"example.com\".",
 			Required:  true,
+			Sensitive: true,
 		}, {
 			Name:      "user",
 			Help:      "SSH username.",
 			Default:   currentUser,
+			Sensitive: true,
 		}, {
 			Name:    "port",
 			Help:    "SSH port number.",
@@ -77,6 +79,7 @@ func init() {
 		}, {
 			Name:      "key_pem",
 			Help:      "Raw PEM-encoded private key.\n\nIf specified, will override key_file parameter.",
+			Sensitive: true,
 		}, {
 			Name: "key_file",
 			Help: "Path to PEM-encoded private key file.\n\nLeave blank or set key-use-agent to use ssh-agent." + env.ShellExpandHelp,
@@ -87,6 +90,7 @@ func init() {
 Only PEM encrypted key files (old OpenSSH format) are supported. Encrypted keys
 in the new OpenSSH format can't be used.`,
 			IsPassword: true,
+			Sensitive:  true,
 		}, {
 			Name: "pubkey_file",
 			Help: `Optional path to public key file.

backend/sharefile/sharefile.go

@@ -155,7 +155,7 @@ func init() {
 				CheckAuth:    checkAuth,
 			})
 		},
-		Options: []fs.Option{{
+		Options: append(oauthutil.SharedOptions, []fs.Option{{
 			Name:     "upload_cutoff",
 			Help:     "Cutoff for switching to multipart upload.",
 			Default:  defaultUploadCutoff,
@@ -182,6 +182,7 @@ standard values here or any folder ID (long hex number ID).`,
 				Value: "top",
 				Help:  "Access the home, favorites, and shared folders as well as the connectors.",
 			}},
+			Sensitive: true,
 		}, {
 			Name:    "chunk_size",
 			Default: defaultChunkSize,
@@ -216,7 +217,7 @@ be set manually to something like: https://XXX.sharefile.com
 				encoder.EncodeLeftSpace |
 				encoder.EncodeLeftPeriod |
 				encoder.EncodeInvalidUtf8),
-		}},
+		}}...),
 	})
 }
 

backend/sia/sia.go

@@ -46,6 +46,7 @@ func init() {
 Note that siad must run with --disable-api-security to open API port for other hosts (not recommended).
 Keep default if Sia daemon runs on localhost.`,
 			Default:   "http://127.0.0.1:9980",
+			Sensitive: true,
 		}, {
 			Name: "api_password",
 			Help: `Sia Daemon API Password.

backend/smb/smb.go

@@ -44,10 +44,12 @@ func init() {
 			Name:      "host",
 			Help:      "SMB server hostname to connect to.\n\nE.g. \"example.com\".",
 			Required:  true,
+			Sensitive: true,
 		}, {
 			Name:      "user",
 			Help:      "SMB username.",
 			Default:   currentUser,
+			Sensitive: true,
 		}, {
 			Name:    "port",
 			Help:    "SMB port number.",
@@ -60,6 +62,7 @@ func init() {
 			Name:      "domain",
 			Help:      "Domain name for NTLM authentication.",
 			Default:   "WORKGROUP",
+			Sensitive: true,
 		}, {
 			Name: "spn",
 			Help: `Service principal name.
@@ -71,6 +74,7 @@ authentication, and it often needs to be set for clusters. For example:
 
 Leave blank if not sure.
 `,
+			Sensitive: true,
 		}, {
 			Name:    "idle_timeout",
 			Default: fs.Duration(60 * time.Second),

backend/storj/fs.go

@@ -101,6 +101,7 @@ func init() {
 				Name:      "access_grant",
 				Help:      "Access grant.",
 				Provider:  "existing",
+				Sensitive: true,
 			},
 			{
 				Name:     "satellite_address",
@@ -123,11 +124,13 @@ func init() {
 				Name:      "api_key",
 				Help:      "API key.",
 				Provider:  newProvider,
+				Sensitive: true,
 			},
 			{
 				Name:      "passphrase",
 				Help:      "Encryption passphrase.\n\nTo access existing objects enter passphrase used for uploading.",
 				Provider:  newProvider,
+				Sensitive: true,
 			},
 		},
 	})

backend/sugarsync/sugarsync.go

@@ -134,12 +134,15 @@ func init() {
 		}, Options: []fs.Option{{
 			Name:      "app_id",
 			Help:      "Sugarsync App ID.\n\nLeave blank to use rclone's.",
+			Sensitive: true,
 		}, {
 			Name:      "access_key_id",
 			Help:      "Sugarsync Access Key ID.\n\nLeave blank to use rclone's.",
+			Sensitive: true,
 		}, {
 			Name:      "private_access_key",
 			Help:      "Sugarsync Private Access Key.\n\nLeave blank to use rclone's.",
+			Sensitive: true,
 		}, {
 			Name:    "hard_delete",
 			Help:    "Permanently delete files if true\notherwise put them in the deleted files.",
@@ -148,10 +151,12 @@ func init() {
 			Name:      "refresh_token",
 			Help:      "Sugarsync refresh token.\n\nLeave blank normally, will be auto configured by rclone.",
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name:      "authorization",
 			Help:      "Sugarsync authorization.\n\nLeave blank normally, will be auto configured by rclone.",
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name:     "authorization_expiry",
 			Help:     "Sugarsync authorization expiry.\n\nLeave blank normally, will be auto configured by rclone.",
@@ -160,14 +165,17 @@ func init() {
 			Name:      "user",
 			Help:      "Sugarsync user.\n\nLeave blank normally, will be auto configured by rclone.",
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name:      "root_id",
 			Help:      "Sugarsync root id.\n\nLeave blank normally, will be auto configured by rclone.",
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name:      "deleted_id",
 			Help:      "Sugarsync deleted folder id.\n\nLeave blank normally, will be auto configured by rclone.",
 			Advanced:  true,
+			Sensitive: true,
 		}, {
 			Name:     config.ConfigEncoding,
 			Help:     config.ConfigEncodingHelp,

backend/swift/swift.go

@@ -118,9 +118,11 @@ func init() {
 		}, {
 			Name:      "user",
 			Help:      "User name to log in (OS_USERNAME).",
+			Sensitive: true,
 		}, {
 			Name:      "key",
 			Help:      "API key or password (OS_PASSWORD).",
+			Sensitive: true,
 		}, {
 			Name: "auth",
 			Help: "Authentication URL for server (OS_AUTH_URL).",
@@ -149,18 +151,23 @@ func init() {
 		}, {
 			Name:      "user_id",
 			Help:      "User ID to log in - optional - most swift systems use user and leave this blank (v3 auth) (OS_USER_ID).",
+			Sensitive: true,
 		}, {
 			Name:      "domain",
 			Help:      "User domain - optional (v3 auth) (OS_USER_DOMAIN_NAME)",
+			Sensitive: true,
 		}, {
 			Name:      "tenant",
 			Help:      "Tenant name - optional for v1 auth, this or tenant_id required otherwise (OS_TENANT_NAME or OS_PROJECT_NAME).",
+			Sensitive: true,
 		}, {
 			Name:      "tenant_id",
 			Help:      "Tenant ID - optional for v1 auth, this or tenant required otherwise (OS_TENANT_ID).",
+			Sensitive: true,
 		}, {
 			Name:      "tenant_domain",
 			Help:      "Tenant domain - optional (v3 auth) (OS_PROJECT_DOMAIN_NAME).",
+			Sensitive: true,
 		}, {
 			Name: "region",
 			Help: "Region name - optional (OS_REGION_NAME).",
@@ -170,15 +177,19 @@ func init() {
 		}, {
 			Name:      "auth_token",
 			Help:      "Auth Token from alternate authentication - optional (OS_AUTH_TOKEN).",
+			Sensitive: true,
 		}, {
 			Name:      "application_credential_id",
 			Help:      "Application Credential ID (OS_APPLICATION_CREDENTIAL_ID).",
+			Sensitive: true,
 		}, {
 			Name:      "application_credential_name",
 			Help:      "Application Credential Name (OS_APPLICATION_CREDENTIAL_NAME).",
+			Sensitive: true,
 		}, {
 			Name:      "application_credential_secret",
 			Help:      "Application Credential Secret (OS_APPLICATION_CREDENTIAL_SECRET).",
+			Sensitive: true,
 		}, {
 			Name:    "auth_version",
 			Help:    "AuthVersion - optional - set to (1,2,3) if your auth URL has no version (ST_AUTH_VERSION).",

backend/uptobox/uptobox.go

@@ -45,6 +45,7 @@ func init() {
 		Options: []fs.Option{{
 			Help:      "Your access token.\n\nGet it from https://uptobox.com/my_account.",
 			Name:      "access_token",
+			Sensitive: true,
 		}, {
 			Help:     "Set to make uploaded files private",
 			Name:     "private",

backend/webdav/webdav.go

@@ -98,6 +98,7 @@ func init() {
 		}, {
 			Name:      "user",
 			Help:      "User name.\n\nIn case NTLM authentication is used, the username should be in the format 'Domain\\User'.",
+			Sensitive: true,
 		}, {
 			Name:       "pass",
 			Help:       "Password.",
@@ -105,6 +106,7 @@ func init() {
 		}, {
 			Name:      "bearer_token",
 			Help:      "Bearer token instead of user/pass (e.g. a Macaroon).",
+			Sensitive: true,
 		}, {
 			Name:     "bearer_token_command",
 			Help:     "Command to run to get a bearer token.",

cmd/config/config.go

@@ -26,6 +26,7 @@ func init() {
 	configCommand.AddCommand(configTouchCommand)
 	configCommand.AddCommand(configPathsCommand)
 	configCommand.AddCommand(configShowCommand)
+	configCommand.AddCommand(configRedactedCommand)
 	configCommand.AddCommand(configDumpCommand)
 	configCommand.AddCommand(configProvidersCommand)
 	configCommand.AddCommand(configCreateCommand)
@@ -118,6 +119,35 @@ var configShowCommand = &cobra.Command{
 	},
 }
 
+var configRedactedCommand = &cobra.Command{
+	Use:   "redacted [<remote>]",
+	Short: `Print redacted (decrypted) config file, or the redacted config for a single remote.`,
+	Long: `This prints a redacted copy of the config file, either the
+whole config file or for a given remote.
+
+The config file will be redacted by replacing all passwords and other
+sensitive info with XXX.
+
+This makes the config file suitable for posting online for support.
+
+It should be double checked before posting as the redaction may not be perfect.
+
+`,
+	Annotations: map[string]string{
+		"versionIntroduced": "v1.64",
+	},
+	Run: func(command *cobra.Command, args []string) {
+		cmd.CheckArgs(0, 1, command, args)
+		if len(args) == 0 {
+			config.ShowRedactedConfig()
+		} else {
+			name := strings.TrimRight(args[0], ":")
+			config.ShowRedactedRemote(name)
+		}
+		fmt.Println("### Double check the config for sensitive info before posting publicly")
+	},
+}
+
 var configDumpCommand = &cobra.Command{
 	Use:   "dump",
 	Short: `Dump the config file as JSON.`,

fs/config/ui.go

@@ -302,19 +302,41 @@ func mustFindByName(name string) *fs.RegInfo {
 	return fs.MustFind(fsType)
 }
 
+// findByName finds the RegInfo for the remote name passed in or
+// returns an error
+func findByName(name string) (*fs.RegInfo, error) {
+	fsType := FileGet(name, "type")
+	if fsType == "" {
+		return nil, fmt.Errorf("couldn't find type of fs for %q", name)
+	}
+	return fs.Find(fsType)
+}
+
 // printRemoteOptions prints the options of the remote
-func printRemoteOptions(name string, prefix string, sep string) {
+func printRemoteOptions(name string, prefix string, sep string, redacted bool) {
-	fs := mustFindByName(name)
+	fsInfo, err := findByName(name)
+	if err != nil {
+		fmt.Printf("# %v\n", err)
+		fsInfo = nil
+	}
 	for _, key := range LoadedData().GetKeyList(name) {
 		isPassword := false
-		for _, option := range fs.Options {
+		isSensitive := false
-			if option.Name == key && option.IsPassword {
+		if fsInfo != nil {
+			for _, option := range fsInfo.Options {
+				if option.Name == key {
+					if option.IsPassword {
 						isPassword = true
-				break
+					} else if option.Sensitive {
+						isSensitive = true
+					}
+				}
 			}
 		}
 		value := FileGet(name, key)
-		if isPassword && value != "" {
+		if redacted && (isSensitive || isPassword) && value != "" {
+			fmt.Printf("%s%s%sXXX\n", prefix, key, sep)
+		} else if isPassword && value != "" {
 			fmt.Printf("%s%s%s*** ENCRYPTED ***\n", prefix, key, sep)
 		} else {
 			fmt.Printf("%s%s%s%s\n", prefix, key, sep, value)
@@ -324,13 +346,19 @@ func printRemoteOptions(name string, prefix string, sep string) {
 
 // listRemoteOptions lists the options of the remote
 func listRemoteOptions(name string) {
-	printRemoteOptions(name, "- ", ": ")
+	printRemoteOptions(name, "- ", ": ", false)
 }
 
 // ShowRemote shows the contents of the remote in config file format
 func ShowRemote(name string) {
 	fmt.Printf("[%s]\n", name)
-	printRemoteOptions(name, "", " = ")
+	printRemoteOptions(name, "", " = ", false)
+}
+
+// ShowRedactedRemote shows the contents of the remote in config file format
+func ShowRedactedRemote(name string) {
+	fmt.Printf("[%s]\n", name)
+	printRemoteOptions(name, "", " = ", true)
 }
 
 // OkRemote prints the contents of the remote and ask if it is OK
@@ -634,6 +662,22 @@ func ShowConfig() {
 	fmt.Printf("%s", str)
 }
 
+// ShowRedactedConfig prints the redacted (unencrypted) config options
+func ShowRedactedConfig() {
+	remotes := LoadedData().GetSectionList()
+	if len(remotes) == 0 {
+		fmt.Println("; empty config")
+		return
+	}
+	sort.Strings(remotes)
+	for i, remote := range remotes {
+		if i != 0 {
+			fmt.Println()
+		}
+		ShowRedactedRemote(remote)
+	}
+}
+
 // EditConfig edits the config file interactively
 func EditConfig(ctx context.Context) (err error) {
 	for {

fs/fs_test.go

@@ -243,6 +243,7 @@ func TestOptionMarshalJSON(t *testing.T) {
 "NoPrefix": false,
 "Advanced": true,
 "Exclusive": false,
+"Sensitive": false,
 "DefaultStr": "false",
 "ValueStr": "true",
 "Type": "bool"

fs/registry.go

@@ -154,6 +154,7 @@ type Option struct {
 	NoPrefix   bool             // set if the option for this should not use the backend prefix
 	Advanced   bool             // set if this is an advanced config option
 	Exclusive  bool             // set if the answer can only be one of the examples (empty string allowed unless Required or Default is set)
+	Sensitive  bool             // set if this option should be redacted when using rclone config redacted
 }
 
 // BaseOption is an alias for Option used internally

lib/oauthutil/oauthutil.go

@@ -84,13 +84,16 @@ All done. Please go back to rclone.
 var SharedOptions = []fs.Option{{
 	Name:      config.ConfigClientID,
 	Help:      "OAuth Client Id.\n\nLeave blank normally.",
+	Sensitive: true,
 }, {
 	Name:      config.ConfigClientSecret,
 	Help:      "OAuth Client Secret.\n\nLeave blank normally.",
+	Sensitive: true,
 }, {
 	Name:      config.ConfigToken,
 	Help:      "OAuth Access Token as a JSON blob.",
 	Advanced:  true,
+	Sensitive: true,
 }, {
 	Name:     config.ConfigAuthURL,
 	Help:     "Auth server URL.\n\nLeave blank to use the provider defaults.",