Package: pwmanager
pwmanagerpwmanager is a python script for storing passwords, searchable by hostname and
user, in a gnupg encrypted git backed database. It can encrypt to multiple keys
and also fetch keys from LDAP, allowing you to easily and securely share and
version control passwords with others. Useful for both personal and group-wide
password storage and sharing.Copyright (C) 2019 Andreas Bofjällandreas@gazonk.org, see LICENSE for
licensing details.Where to get itThe latest release is available at PyPI:https://pypi.org/project/pwmanager/Source code repository is at github:https://github.com/andbof/pwmanagerBasic installationQuickest and easiest is to install usingpip3from PyPI as your local user:pip3 install --user pwmanagerYou can also install the latest development version directly from the github
repository:pip3 install --user git+git://github.com/andbof/pwmanager.gitSome options need to be set in the configuration file. A samplepwmanager.conf(pwmanager.conf.sample) is included in the package. pip3
will install it in thepwmanager/datasubdirectory of the appropriate
pythonsite-packagesdirectory. It should be put in$HOME/.pwmanager/The standard location for your password repository is$HOME/.pwmanager/datapwmanager requires python3 >= 3.4 and some extra packages, seesetup.pyfor
details. Python 2.x is not supported.Using itGetting helppwmanager -hHelp on actions is available by appending -h:pwmanager add -hStoring passwordsAdding the passwordsecretpassfor the accountrootonhost.company.comto the database:pwmanager add host.company.com root secretpassIf you leave outsecretpass, pwmanager will prompt you for the
password.Retrieving passwordsRetrieving the password stored above:pwmanager get host.company.com rootNotepwmanager getmatches both the hostname and username as substrings and
if you do not specify a username it will list all accounts, so all of these
will find the above account (and maybe others):pwmanager get host.company.com roo
pwmanager get host.company.com oot
pwmanager get host.company.com r
pwmanager get host.company.com r
pwmanager get host.company.co
pwmanager get com
pwmanager get hSynchronizing with otherspwmanager will always update from and push tooriginwhen there is anorigingit remote configured. git addsoriginautomatically if you
clone an already existing repository, but you need to add it manually if you
initialize it yourself or usepwmanager init.To add a remote repository later, use the normal git way:cd /path/to/datastore
git remote add origin URLIn normal operation, pwmanager will, before doing anything, always fetch and
rebase on the latestorigin/master, and will push toorigin/masterafterwards. It will also retry this up to five times in case multiple people
are in a rebase-race and pushing at the same time. However, if you just added a
new origin remote it's a good idea to manually run:git fetch origin
git rebase origin/masterIf any of the two commands above fail, you need to fix whatever git complains
about or pwmanager will not work.How are the passwords stored?(aka When the script doesn't work and you desperately need a password)All passwords are stored in separate files, one per password, in your datadir.
They are encrypted using GnuPG to all keys you configured to use, so if you
have a suitable key available in your local gnupg keyring and you want the
password for 'user' on 'host', you can do so by just running gnupg:gpg -o - -d datadir/host/user.gpgIf this fails, ensure you have your secret key in your gnupg keyring.Why is every password in a separate file, you ask? Because that enables
replacing individual passwords without having access to any secret key. This
allows automated password rotation, for example.TroubleshootingDecryption failedgnupg could probably not find your secret key. Make sure your secret key is
available in your standard keyring in~/.gnupgand that you're running the
latest gnupg 2.x series.For debian stretch you need to installpython3-gnupgfrom
stretch-backports.If your system defaults to gnupg 1.x and your gnupg 2.x binary is called gpg2,
setgpg_path = gpg2in the[gnupg]section ofpwmanager.conf.RuntimeError: No recipients to encrypt to!You haven't added any key fingerprints inpwmanager.confand haven't
configured any other data source. There are simply no public keys configured to
encrypt to."I don't understand how to get the LDAP stuff working at all"pwmanager currently assumes you have a group (objectClass: posixGroup) with
amemberUidattribute for every member. Those should map to whatever you've
set asuser_attrinpwmanager.conf.Next, pwmanager assumes the user has the attribute you've set askey_attr,
which should be the DN of a PGP keyserver compatible entry underkey_dn,
normallyou=PGP Keys,dc=company,dc=com.The same LDAP server must be able to act as a PGP compatible keyserver (hint:gpg --send-keysshould work). Also, don't forget to uncomment the[ldap]header inpwmanager.conf.Known issuespwmanager does not callmlock(), mostly because doing so would require
callingmlock()for the entire ~5 MB python binary.pwmanager currently does not support multiple git remotes. That should
probably be implemented, for numerous reasons.