Skip to content

Commit

Permalink
Update category
Browse files Browse the repository at this point in the history
  • Loading branch information
@mikemyl
mikemyl committed Nov 18, 2018
1 parent de111c3 commit 765a9cc
Show file tree
Hide file tree
Showing 2 changed files with 26 additions and 22 deletions.
42 changes: 20 additions & 22 deletions _posts/2018-01-30-unix-pass.md
View file
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
---
layout: post
section-type: post
title: "Unix Password Manager - aka pass"
description: "Setup unix pass with pgp and git"
category: Tech
title: Unix Password Manager - aka pass
description: Setup unix pass with pgp and git
category: Unix
tags: [ 'tutorial', 'unix', 'git' ]
---

Expand Down Expand Up @@ -34,7 +34,7 @@ In most Linux distributions GnuPG toolchain should already be installed and is a
If not, get the latest verion from [GnuPG website](https://www.gnupg.org/download/). Make sure you use a GnuPG version > 2
(in Ubuntu for example, that would be the `gpg2` command):

<pre><code class="shell"><span class="noselect">$ </span>gpg --version
<pre><code class="bash"><span class="noselect">$ </span>gpg --version
gpg (GnuPG) 2.2.5
libgcrypt 1.8.2
Copyright (C) 2018 Free Software Foundation, Inc.
Expand All @@ -52,7 +52,7 @@ Compression: Uncompressed, ZIP, ZLIB, BZIP2 </code></pre>

So let's generate our gpg key using the following command:

<pre><code class="shell"><span class="noselect">$ </span>gpg --full-generate-key </code></pre>
<pre><code class="bash"><span class="noselect">$ </span>gpg --full-generate-key </code></pre>

I went with the default options for the key type (RSA and RSA), and the key size (2048). I could have selected a
4096-bits long key, but I intend to use with my [Youbikey Neo](https://www.yubico.com/products/yubikey-hardware/yubikey-neo/) and it doesn't
Expand All @@ -62,7 +62,7 @@ remember our credentials for all those services that we use so a single key's pa

We can verify that the key was successfully generated, using the command below:

<pre><code class="shell"><span class="noselect">$ </span>gpg -K
<pre><code class="bash"><span class="noselect">$ </span>gpg -K
gpg: checking the trustdb
gpg: marginals needed: 3 completes needed: 1 trust model: pgp
gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u
Expand All @@ -80,19 +80,19 @@ ssb rsa2048 2018-06-10 [E] [expires: 2019-06-10] </code></pre>
Pass is available on all major linux distributions, so it should be easy to install using the package manager. In Arch
linux that would be pacman, and we can easily install pass.

<pre><code class="shell"><span class="noselect">$ </span>pacman -S pass </code></pre>
<pre><code class="bash"><span class="noselect">$ </span>pacman -S pass </code></pre>

#### Initialise pass

In order to set up pass, we need to run the following:

<pre><code class="shell"><span class="noselect">$ </span>pass init [email protected] </code></pre>
<pre><code class="bash"><span class="noselect">$ </span>pass init [email protected] </code></pre>


Note that we used the same email address of our secret gpg key.
Let's also enable the git integration:

<pre><code class="shell"><span class="noselect">$ </span>pass git init</code></pre>
<pre><code class="bash"><span class="noselect">$ </span>pass git init</code></pre>

Now our password store (the _~/.password-store_ directory) is a git repository, so we can utilize git to keep our password
synced between our multiple devices (we ll see how in a next section).
Expand All @@ -103,7 +103,7 @@ synced between our multiple devices (we ll see how in a next section).
Now let's export our private key so that we can import it into our other devices. It also makes sense to save it somewhere
"safe" as a backup.

<pre><code class="shell"><span class="noselect">$ </span>gpg --export-secret-keys > secret.asc</code></pre>
<pre><code class="bash"><span class="noselect">$ </span>gpg --export-secret-keys > secret.asc</code></pre>


### Using pass
Expand All @@ -113,7 +113,7 @@ Now let's export our private key so that we can import it into our other devices

Now we are ready to start using pass. Let's generate our first simple password, for the website _test.com_:

<pre><code class="shell"><span class="noselect">$ </span>pass generate test.com 10
<pre><code class="bash"><span class="noselect">$ </span>pass generate test.com 10
[master e065551] Add generated password for test.com.
1 file changed, 0 insertions(+), 0 deletions(-)
create mode 100644 test.com.gpg
Expand All @@ -126,18 +126,17 @@ the pass generate command specifies the password length. We can use the `-n or -
chars. Our password is stored at the file _~/.password-store/test.com.gpg_ in an encrypted format. The file looks
like this:

<pre><code class="shell"><span class="noselect">$ </span>cat .password-store/test.com/test.gpg
<pre><code class="bash"><span class="noselect">$ </span>cat .password-store/test.com/test.gpg
�}����X��t~�O���^d][&����e��q6��Gah��/4X#�-���6j����y�P�Cj���!)�h��I�W�-ݐ������MU����"�c�0GyWA�S�aI�?NHl�C�΅NI�
c&c/b�M���ЫMψ"Ԃ7����b"Lw�0Y8M�NQԜ0���h�@G-�����E��u��B�@��4�X���5,�򧤶/}TʟS�x�J�YW,E��܂�@�&�a&����4��T@�=�PS���<�%p�{'�d�Jo'ԈjO��ë~/h��DG��%(�V�������(�K��Zi�[a� </code></pre>



#### Insert an existing password

Now let's insert an already existing password.


<pre><code class="shell"><span class="noselect">$ </span>pass insert social/twitter
<pre><code class="bash"><span class="noselect">$ </span>pass insert social/twitter
mkdir: created directory '/home/mike/.password-store/social'
Enter password for social/twitter:
Retype password for social/twitter:
Expand All @@ -151,15 +150,15 @@ Retype password for social/twitter:

We can see what passwords exist in the password store usgin the `pass ls` command:

<pre><code class="shell"><span class="noselect">$ </span>pass ls
<pre><code data-trim class="bash"><span class="noselect">$ </span>pass ls
Password Store
├── social
│   └── twitter
└── test.com </code></pre>

We can reveal a password like this:

<pre><code class="shell"><span class="noselect">$ </span>pass test.com
<pre><code class="bash"><span class="noselect">$ </span>pass test.com
+U%90>_*=Y </code></pre>

If we pass the `-c` flag on the above command the password is copied to our clipboard and stays there for 45 seconds by
Expand All @@ -174,7 +173,7 @@ password using the `pass edit` command, in which case the text editor specified
open up and let us modify the file. We can also use the `-m` flag in the _pass insert_ command to add the details
in one go:

<pre><code class="shell"><span class="noselect">$ </span>pass insert -m github
<pre><code class="bash"><span class="noselect">$ </span>pass insert -m github
Enter contents of github and press Ctrl+D when finished:
mypassword
url: github.com
Expand All @@ -187,7 +186,7 @@ username: myusername

We can easily remove an existing password:

<pre><code class="shell"><span class="noselect">$ </span>pass rm github
<pre><code class="bash"><span class="noselect">$ </span>pass rm github
Are you sure you would like to delete github? [y/N] y
removed '/home/mike/.password-store/github.gpg'
[master 99c7fda] Remove github from store.
Expand All @@ -201,7 +200,7 @@ removed '/home/mike/.password-store/github.gpg'
As we have enabled git integration in the beginning of this guide our passwords are stored encrypted in a
full-fledged git repository. We can examine the repo using the normal git commands prepended by pass:

<pre><code class="shell"><span class="noselect">$ </span>pass git log
<pre><code class="bash"><span class="noselect">$ </span>pass git log
commit 791253d6ad8bd4149f1106a3a32f1d65c55c34df (HEAD -> master)
Author: Mike <[email protected]>
Date: Sat Jun 16 17:58:00 2018 +0100
Expand Down Expand Up @@ -230,13 +229,12 @@ be decrypted) the filenames are not encrypted so one could see the websites / se

We could use a private or a self-hosted git repository as a workaround:

<pre><code class="shell"><span class="noselect">$ </span>pass git remote add origin [email protected]:username/private-git-repo.git </code></pre>
<pre><code class="bash"><span class="noselect">$ </span>pass git remote add origin [email protected]:username/private-git-repo.git </code></pre>


And then push our password-store to the remote:

<pre><code class="shell"><span class="noselect">$ </span>pass git push origin master </code></pre>

<pre><code class="bash"><span class="noselect">$ </span>pass git push origin master </code></pre>

Now all we have to do is import our private key (using the .asc file that we have exported) into our other device and
clone the repo to start using pass and have our passwords synced!
Expand Down
6 changes: 6 additions & 0 deletions categories/unix.html
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
---
layout: category
section-type: category
title: Unix
---
## Category

0 comments on commit 765a9cc

Please sign in to comment.