It's 2021, and it's finally time to do something about your passwords. A few years ago I wrote a short introduction to password managers, including an introduction to what they do, what they are, why you should definitely be using one, and which ones are available on Linux. My original post is here:
https://ubuntuforums.org/showthread....796&p=13588049
If you don't have a password manager, you definitely should. You can start small by just using one to store your banking information, or other logins you don't need every day, but which require strong password protection. Before long, you'll get your mind around it and you'll be using it for all your accounts.
My criteria for inclusion in the list is that it should be available on Linux and *bsd, that it would be nice if it were also available on other platforms (including MS Windows, Android, iOS, and MacOS), and that it should, but need not, sync with the cloud. You can review my notes about Password Gorilla, LastPass, KeePassX, and Encrpytr. Not included in that original list:
Lockwise: This is the default password manager included in Mozilla Firefox. If you "sync" your firefox accounts, you'll find that your passwords are also sync'd on the desktop. Lockwise is also available in the Android and iOS store. If you're using FF, you're probably using Lockwise, whether you know it or not. You can sync your mobile device with your desktop and access your passwords on any device.
For most regular people, LastPass is a really good choice. It's free, easy to use, comes with a FF plugin, and has some notable premium features.
However, at the time, I recommended Encryptr by SpiderOak. First, it's extremely simple; many other password managers are bloated with confusing or unnecessary features. Second, it syncs to the cloud using SpiderOak's strong end-to-end encryption. And third, it comes recommended by Edward Snowden. Unfortunately, come 2021, SpiderOak will sunset the Encryptr project. On their website, Encyptr recommends moving either to 1password or bitwarden, and has included simple scripts to export to either of those platforms. If you use Encryptr, you need to export your data.
As a replacement, I've finally decided to switch to pass, "the standard Unit password manager". Pass is an extremely light, easy to use, feature rich password manager that follows the unix philosophy: it does one thing well, but also takes advantage of interoperability with a suite of unix tools. Passwords live inside a png encypted file, which live in your home directory. That's it. As the same time, there are a number of community projects and extensions for pass, including GUIs and Android and iOS apps.
Setting up pass is easy. After installing on your machine, run
Code:
$ gpg2 --full-gen-key
This will generate the gpg2 key. Unless you're on a very old machine, choose 4096. Set up your pass phrase. You must remember this pass phrase. It should be impossible to guess, but rememberable by you. You must remember this pass phrase. Don't forget it. OK?
Next run
Code:
$ pass init user@email
This will create the ~/.password-store directory. At this point, you can include git functionality by also running
This will create a git repository in your ~/.password-store/.git/ directory. Git repositories allow for local cloning, push'ing, pull'ing, and version control of your password repo. It is very handy.
That's it. You're done. Now create a saved password with
Code:
$ pass insert google/username
pass will prompt you for your google password, and save it in your pass directory. You can save additional google passwords simply by
Code:
$ pass insert google/username2
In addition to those two google account passwords, let's also throw in a:
Code:
$ pass insert yahoo/username
See your full tree of passwords with a simple
In the above example, it would look like this:
Code:
$ pass
Password Store
├── google
│** ├── username
│** └── usename2
├── yahoo
│** ├── username
Retrieving your passwords from pass is just as simple. In the example above, type:
Code:
$ pass google/username
Notice that pass respects tab completion. Type in your gpg2 password (not your google password, obviously) to access the file, and it spits out your google password. What could be easier?
I keep my ~/.password-store dir in my home directory on a public facing web server, to which I have ssh access, and on which git is installed, meaning I can ssh in to run pass on the CLI. However, I can also access my passwords on my local machine. On the server, which is where my google password is stored, run:
Code:
$ gpg2 --export-secret-keys > secret-keys.gpg
Move the file secret-keys.gpg to your local machine
Code:
$ scp secret-keys.gpg username@local.machine.ip:~/
and then on the local machine, run:
Code:
$ gpg2 --import ~/secret-keys.gpg
This imports your keys from the server to your local machine. Finally, on the local machine:
Code:
$ git clone remote.machine.ip:~/.password-store
Your .password-store is now locally saved. You can run pass commands as you normally would. Try it with the -c flag to copy your password right to the clipboard, rather than to stdout. And with git integration, you have version control, meaning you can look back at old passwords. I can also push local changes back to the server. And of course, git is fantastically feature rich, so check out these extended git examples to get your money's worth: https://git.zx2c4.com/password-store...0GIT%20EXAMPLE
For example, one very cool use is to now use pass to credential your remote git repositories on, e.g., GH by defining mappings between hosts and fields in the password-store. The possibilities are literally endless: do one thing and do it well, integrating with a suite of available unix tools.
I will not recommend that you read the man page for pass, since moderators on ubuntuforums get all butt hurt when I do that, but I wouldn't run the software with out it. If you do read the manual, you'll find any number of useful features and examples.
Finally, as always, don't forget to practice good gpg keypair hygiene!
Adv Reply
Originally Posted by kevdog
Bookmarks