7

I'm looking for a password manager for the Linux (Debian/Ubuntu) command line to be used by a department of developers.

We are currently using pwman3 and content with it but want to migrate to a program that does not change its database format so often in incompatible ways.

What I need:

  • must be available as a Linux (Ubuntu LTS, Debian) command line application
  • secure storage (i.e. good encryption)
  • centralized storage possible (an NFS share or a Git repo would be good enough), no cloud please
  • data file location should be configurable
  • free/open source software

Preferred options (not mandatory)

  • nice GUI
  • is contained in Ubuntu repositories (PPA is fine, a .deb would do, no problems if it comes as .jar or ready-to-go .tar.gz however, or source if not too many dependencies (we feel fit enough to configure && make && check-install ;))

Candidates tried, but failed:

  • pwman3: We use it now with a central DB file (shared via NFS), but the DB format was changed in an incompatible way between Ubuntu 14.04 and 15.10, so that the 14.04 clients can not read the DB stored by 15.10.
  • pwsafe: A command line client for Password Safe files, but sadly it has not been updated since 2005.
  • 2
    For the very same issue (collection of username/password) we've used a plain text file with two GPG scripts: 1 script to only "view" and 1 to edit (add/change entries). The file would be encrypted using the public keys of all participants, so each dev can decrypt it with his/her private key. Easy approach, no permanently changing database formats :) – Izzy Apr 26 '16 at 9:59
  • 1
    Afraid not. That was a customer I worked for several years ago, and I didn't create the scripts. But with the concept in mind, it shouldn't be too complicated to create them (not that I volunteer ;) Quick hint: Encrypting and decrypting documents - GnuPG and on our sister site Encryption with multiple different keys? – Izzy Apr 26 '16 at 12:38
  • 1
    Great question now! – Nicolas Raoul Apr 26 '16 at 13:20
  • 1
    Does LastPass meat your openness requirement? The CLI client is open source (indeed, it's even packaged in Debian), but the service it uses is not. – derobert May 13 '16 at 18:21
  • 1
    @derobert: Question is updated: "No cloud please" – Martin Schröder May 13 '16 at 23:59
3

Kruptos

I was similarly dissatisfied with most password managers and wanted a minimalist/command-line alternative, so I created Kruptos. Kruptos simply encrypts and decrypts the ~/.kruptos/ directory. This provides several benefits:

  • Non-intrusive: store sensitive info the way you want
  • Flexible lookup: search/modify passwords with command line tools
  • Modifiable: the source code is simple and easily changed
  • Distributable: compresses to a tarball when encrypted

Usage

Kruptos has 3 pieces of functionality:

  • Initialize: create ~/.kruptos/ and ~/.kruptos/.phrazein with default master password pswd
    • The first line of .phrazein is the master password
  • Encrypt: compress, encrypt and then remove ~/.kruptos/ which creates the tarball
  • Decrypt: decrypt, decompress and then remove .kruptos.tar.gz.aes which creates the directory
+===============+===========+
| Functionality | Command   |
+===============+===========+
| Initialize    | kruptos i |
+---------------+-----------+
| Encrypt       | kruptos e |
+---------------+-----------+
| Decrypt       | kruptos   |
+===============+===========+

Code

function kruptos
{
    if [[ $# -eq 1 ]]; then
        DOWHAT="$1"
    else
        DOWHAT="d"
    fi
    if [[ $DOWHAT == "d" ]]; then
        #Decrypt
        pushd . &>/dev/null
        cd ~/
        openssl aes-256-cbc -d  -in .kruptos.tar.gz.aes | tar -xz -f - --strip-components=2 && rm ~/.kruptos.tar.gz.aes
        popd &>/dev/null
    elif [[ $DOWHAT == "e" ]]; then
        #Encrypt
        tar -zcf - ~/.kruptos | openssl aes-256-cbc -out ~/.kruptos.tar.gz.aes -kfile ~/.kruptos/.phrazein && rm -r ~/.kruptos
    elif [[ $DOWHAT == "i" ]]; then
        #Initialize
        mkdir ~/.kruptos
        echo pswd > ~/.kruptos/.phrazein
    else
        echo "$DOWHAT is not an acceptable flag"
    fi
}

Origins

Kruptos

Kruptos origins

Phrazein

enter image description here

2

KeePass

The KeePass is available under http://keepass.info/ . There is a command line client http://kpcli.sourceforge.net/ or a Java API so you can roll your own.

I am using it for years now and it works well on Mac, Win, and Linux.

0

Passme

I made a password manager for the command line. Just install it with:

sudo apt install python3-pip  
sudo pip3 install passme

It stores the information of "seed for password" in a text file, and you can manage it with git. It creates your password from "seed for password" and a master password you remember. It can also create a html file to be used from your mobile device.

For what you need:

  • It is available from the Linux command line.
  • Only the "seed for password" is stored, which does not reveal your password unless your master password is known.
  • It uses only a single text file, which is easily manageable with git repo.
  • Data file location is configurable.
  • MIT license

For more information:

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.