-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
6 changed files
with
66 additions
and
85 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -34,29 +34,25 @@ In most Linux distributions GnuPG toolchain should already be installed and is a | |
If not, get the latest verion from [GnuPG website](https://www.gnupg.org/download/). Make sure you use a GnuPG version > 2 | ||
(in Ubuntu for example, that would be the `gpg2` command): | ||
|
||
{% highlight shell %} | ||
gpg --version | ||
<pre><code class="shell"><span class="noselect">$ </span>gpg --version | ||
gpg (GnuPG) 2.2.5 | ||
libgcrypt 1.8.2 | ||
Copyright (C) 2018 Free Software Foundation, Inc. | ||
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html> | ||
This is free software: you are free to change and redistribute it. | ||
There is NO WARRANTY, to the extent permitted by law. | ||
|
||
Home: /home/mike/foo | ||
Supported algorithms: | ||
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA | ||
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, | ||
CAMELLIA128, CAMELLIA192, CAMELLIA256 | ||
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224 | ||
Compression: Uncompressed, ZIP, ZLIB, BZIP2 | ||
{% endhighlight %} | ||
Compression: Uncompressed, ZIP, ZLIB, BZIP2 </code></pre> | ||
|
||
|
||
So let's generate our gpg key using the following command: | ||
|
||
{% highlight shell %} | ||
gpg --full-generate-key | ||
{% endhighlight %} | ||
<pre><code class="shell"><span class="noselect">$ </span>gpg --full-generate-key </code></pre> | ||
|
||
I went with the default options for the key type (RSA and RSA), and the key size (2048). I could have selected a | ||
4096-bits long key, but I intend to use with my [Youbikey Neo](https://www.yubico.com/products/yubikey-hardware/yubikey-neo/) and it doesn't | ||
|
@@ -66,8 +62,7 @@ remember our credentials for all those services that we use so a single key's pa | |
|
||
We can verify that the key was successfully generated, using the command below: | ||
|
||
{% highlight shell %} | ||
$ gpg -K | ||
<pre><code class="shell"><span class="noselect">$ </span>gpg -K | ||
gpg: checking the trustdb | ||
gpg: marginals needed: 3 completes needed: 1 trust model: pgp | ||
gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u | ||
|
@@ -77,34 +72,27 @@ gpg: next trustdb check due at 2019-06-10 | |
sec rsa2048 2018-06-10 [SC] [expires: 2019-06-10] | ||
15E886BF97A7828A2F5795DBC22FADC6585FDF18 | ||
uid [ultimate] Michail Mylonakis (My gpg key) <[email protected]> | ||
ssb rsa2048 2018-06-10 [E] [expires: 2019-06-10] | ||
{% endhighlight %} | ||
ssb rsa2048 2018-06-10 [E] [expires: 2019-06-10] </code></pre> | ||
|
||
|
||
#### Install pass | ||
|
||
Pass is available on all major linux distributions, so it should be easy to install using the package manager. In Arch | ||
linux that would be pacman, and we can easily install pass. | ||
|
||
{% highlight shell %} | ||
pacman -S pass | ||
{% endhighlight %} | ||
|
||
|
||
<pre><code class="shell"><span class="noselect">$ </span>pacman -S pass </code></pre> | ||
|
||
#### Initialise pass | ||
|
||
In order to set up pass, we need to run the following: | ||
|
||
{% highlight shell %} | ||
pass init [email protected] | ||
{% endhighlight %} | ||
<pre><code class="shell"><span class="noselect">$ </span>pass init [email protected] </code></pre> | ||
|
||
|
||
Note that we used the same email address of our secret gpg key. | ||
Let's also enable the git integration: | ||
|
||
{% highlight shell %} | ||
pass git init | ||
{% endhighlight %} | ||
<pre><code class="shell"><span class="noselect">$ </span>pass git init</code></pre> | ||
|
||
Now our password store (the _~/.password-store_ directory) is a git repository, so we can utilize git to keep our password | ||
synced between our multiple devices (we ll see how in a next section). | ||
|
@@ -115,9 +103,7 @@ synced between our multiple devices (we ll see how in a next section). | |
Now let's export our private key so that we can import it into our other devices. It also makes sense to save it somewhere | ||
"safe" as a backup. | ||
|
||
{% highlight shell %} | ||
gpg --export-secret-keys > secret.asc | ||
{% endhighlight %} | ||
<pre><code class="shell"><span class="noselect">$ </span>gpg --export-secret-keys > secret.asc</code></pre> | ||
|
||
|
||
### Using pass | ||
|
@@ -127,61 +113,54 @@ gpg --export-secret-keys > secret.asc | |
|
||
Now we are ready to start using pass. Let's generate our first simple password, for the website _test.com_: | ||
|
||
{% highlight shell %} | ||
pass generate test.com 10 | ||
<pre><code class="shell"><span class="noselect">$ </span>pass generate test.com 10 | ||
[master e065551] Add generated password for test.com. | ||
1 file changed, 0 insertions(+), 0 deletions(-) | ||
create mode 100644 test.com.gpg | ||
The generated password for test.com is: | ||
+U%90>_*=Y | ||
{% endhighlight %} | ||
+U%90>_*=Y </code></pre> | ||
|
||
|
||
In the last line above, we see the (randomly) generated password. The number 10 that we passed as the last argument of | ||
the pass generate command specifies the password length. We can use the `-n or --no-symbols` option to blacklist specific | ||
chars. Our password is stored at the file _~/.password-store/test.com.gpg_ in an encrypted format. The file looks | ||
like this: | ||
|
||
{% highlight shell %} | ||
cat .password-store/test.com/test.gpg | ||
��}����X��t~�O���^d][&����e��q6��Gah��/4X#�-���6j����y�P�Cj���!)�h��I�W�-ݐ������MU����"�c�0GyWA�S�aI�?NHl�C�΅NI� | ||
c&c/b�M���ЫMψ"Ԃ7����b"Lw�0Y8M�NQԜ0���h�@G-�����E��u��B�@��4�X���5,�/}TʟS�x�J�YW,E��܂�@�&�a&����4��T@�=�PS���<�%p�{'�d�Jo'ԈjO��ë~/h��DG��%(�V�������(�K��Zi�[a� | ||
{% endhighlight %} | ||
<pre><code class="shell"><span class="noselect">$ </span>cat .password-store/test.com/test.gpg | ||
�}����X��t~�O���^d][&����e��q6��Gah��/4X#�-���6j����y�P�Cj���!)�h��I�W�-ݐ������MU����"�c�0GyWA�S�aI�?NHl�C�΅NI� | ||
c&c/b�M���ЫMψ"Ԃ7����b"Lw�0Y8M�NQԜ0���h�@G-�����E��u��B�@��4�X���5,�/}TʟS�x�J�YW,E��܂�@�&�a&����4��T@�=�PS���<�%p�{'�d�Jo'ԈjO��ë~/h��DG��%(�V�������(�K��Zi�[a� </code></pre> | ||
|
||
|
||
|
||
#### Insert an existing password | ||
|
||
Now let's insert an already existing password. | ||
|
||
{% highlight shell %} | ||
pass insert social/twitter | ||
|
||
<pre><code class="shell"><span class="noselect">$ </span>pass insert social/twitter | ||
mkdir: created directory '/home/mike/.password-store/social' | ||
Enter password for social/twitter: | ||
Retype password for social/twitter: | ||
[master d2f3237] Add given password for social/twitter to store. | ||
1 file changed, 0 insertions(+), 0 deletions(-) | ||
create mode 100644 social/twitter.gpg | ||
{% endhighlight %} | ||
create mode 100644 social/twitter.gpg </code></pre> | ||
|
||
We can organize the password store directory structure into categories, as seen bellow. | ||
|
||
#### Retrieve a password | ||
|
||
We can see what passwords exist in the password store usgin the `pass ls` command: | ||
|
||
{% highlight shell %} | ||
pass ls | ||
<pre><code class="shell"><span class="noselect">$ </span>pass ls | ||
Password Store | ||
├── social | ||
└── test.com | ||
{% endhighlight %} | ||
└── test.com </code></pre> | ||
|
||
We can reveal a password like this: | ||
|
||
{% highlight shell %} | ||
pass test.com | ||
+U%90>_*=Y | ||
{% endhighlight %} | ||
<pre><code class="shell"><span class="noselect">$ </span>pass test.com | ||
+U%90>_*=Y </code></pre> | ||
|
||
If we pass the `-c` flag on the above command the password is copied to our clipboard and stays there for 45 seconds by | ||
default. | ||
|
@@ -195,30 +174,25 @@ password using the `pass edit` command, in which case the text editor specified | |
open up and let us modify the file. We can also use the `-m` flag in the _pass insert_ command to add the details | ||
in one go: | ||
|
||
{% highlight shell %} | ||
pass insert -m github | ||
<pre><code class="shell"><span class="noselect">$ </span>pass insert -m github | ||
Enter contents of github and press Ctrl+D when finished: | ||
|
||
mypassword | ||
url: github.com | ||
username: myusername | ||
[master 791253d] Add given password for github to store. | ||
1 file changed, 0 insertions(+), 0 deletions(-) | ||
create mode 100644 github.gpg | ||
{% endhighlight %} | ||
create mode 100644 github.gpg </code></pre> | ||
|
||
#### Remove a password | ||
|
||
We can easily remove an existing password: | ||
|
||
{% highlight shell %} | ||
pass rm github | ||
<pre><code class="shell"><span class="noselect">$ </span>pass rm github | ||
Are you sure you would like to delete github? [y/N] y | ||
removed '/home/mike/.password-store/github.gpg' | ||
[master 99c7fda] Remove github from store. | ||
1 file changed, 0 insertions(+), 0 deletions(-) | ||
delete mode 100644 github.gpg | ||
{% endhighlight %} | ||
delete mode 100644 github.gpg </code></pre> | ||
|
||
### Git integration | ||
|
||
|
@@ -227,8 +201,7 @@ removed '/home/mike/.password-store/github.gpg' | |
As we have enabled git integration in the beginning of this guide our passwords are stored encrypted in a | ||
full-fledged git repository. We can examine the repo using the normal git commands prepended by pass: | ||
|
||
{% highlight shell %} | ||
pass git log | ||
<pre><code class="shell"><span class="noselect">$ </span>pass git log | ||
commit 791253d6ad8bd4149f1106a3a32f1d65c55c34df (HEAD -> master) | ||
Author: Mike <[email protected]> | ||
Date: Sat Jun 16 17:58:00 2018 +0100 | ||
|
@@ -246,8 +219,8 @@ Author: Mike <[email protected]> | |
Date: Sat Jun 16 17:51:23 2018 +0100 | ||
|
||
Edit password for test.com using vi. | ||
... | ||
{% endhighlight %} | ||
... </code></pre> | ||
|
||
|
||
#### Adding a remote | ||
|
||
|
@@ -257,15 +230,12 @@ be decrypted) the filenames are not encrypted so one could see the websites / se | |
|
||
We could use a private or a self-hosted git repository as a workaround: | ||
|
||
{% highlight shell %} | ||
pass git remote add origin [email protected]:username/private-git-repo.git | ||
{% endhighlight %} | ||
<pre><code class="shell"><span class="noselect">$ </span>pass git remote add origin [email protected]:username/private-git-repo.git </code></pre> | ||
|
||
|
||
And then push our password-store to the remote: | ||
|
||
{% highlight shell %} | ||
pass git push origin master | ||
{% endhighlight %} | ||
<pre><code class="shell"><span class="noselect">$ </span>pass git push origin master </code></pre> | ||
|
||
Now all we have to do is import our private key (using the .asc file that we have exported) into our other device and | ||
clone the repo to start using pass and have our passwords synced! | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters