Replacement script for the `pdnsutil hash-password` command

pdns_hash_password.py

#!/usr/bin/env python3
#
# Replacement script for the `pdnsutil hash-password` command
#

from base64 import b64encode
from getpass import getpass
from hashlib import scrypt
from os import urandom
from sys import argv

default_cost_factor = 14
scrypt_r = 8
scrypt_p = 1
scrypt_len = 32


def hash_password(password, *, cost_factor=default_cost_factor):
    salt = urandom(16)
    password_hashed = scrypt(
        password,
        salt=salt,
        n=pow(2, cost_factor),
        r=scrypt_r,
        p=scrypt_p,
        dklen=scrypt_len,
    )
    salt_b64 = b64encode(salt).decode()
    password_hashed_b64 = b64encode(password_hashed).decode()
    return f"$scrypt$ln={cost_factor},p={scrypt_p},r={scrypt_r}${salt_b64}${password_hashed_b64}"


def main():
    cost_factor = default_cost_factor if len(argv) < 2 else int(argv[1])
    password = getpass().encode()
    hashed_password = hash_password(password, cost_factor=cost_factor)
    print(f"{hashed_password}")


if __name__ == "__main__":
    main()