Package: sagecipher
sageciphersagecipher(sshagentcipher) provides an AES cipher, whose key is obtained by signing nonce data via SSH agent.  This is illustrated below.This can be used in turn by thekeyringlibrary, and byansible-vaultto encrypt/decrypt files or secrets via the users' local or forwarded ssh-agent session.ContentsInstallationUsageUsing the keyring backendUsing with ansible-vaultUsing sagecipher directly in PythonUsing the sagecipher CLI toolInstallationpipinstallsagecipherUsageBefore using,ssh-agentmust be running with at least one ssh-key available for producing cipher key material:$source<(ssh-agent)Agent pid 3710$ssh-addEnter passphrase for /home/somebody/.ssh/id_rsa:Identity added: /home/somebody/.ssh/id_rsa (/home/somebody/.ssh/id_rsa)Using the keyring backendHere we will set the following environment variables:Environment VariableValueDescriptionPYTHON_KEYRING_BACKENDsagecipher.keyring.KeyringTellskeyringexplicitly to use thesagecipherbackendKEYRING_PROPERTY_SSH_KEY_FINGERPRINT<hex fingerprint of ssh key>Pre-selects the SSH key for thesagecipherbackend to useIf no other keyring backends are available, sagecipher will be selected as the default backend with apriorityof 1.  ThePYTHON_KEYRING_BACKENDenvironment variable can be set to explicitly set the backend.  See thekeyring docsfor more help using the keyring library.$sagecipherlist-keys# paramiko does not yet expose key comments, unfortunately..[ssh-rsa] e8:19:fe:c5:0a:b4:57:5d:96:27:b3:e3:ec:ba:24:3c[ssh-rsa] 38:c5:94:45:ca:01:65:d1:d0:c5:ee:5e:cd:b3:94:39$exportPYTHON_KEYRING_BACKEND=sagecipher.keyring.Keyring$keyringsetsvcuser1Password for 'user' in 'svc':Please select from the following keys...[1] ssh-rsa e8:19:fe:c5:0a:b4:57:5d:96:27:b3:e3:ec:ba:24:3c[2] ssh-rsa 38:c5:94:45:ca:01:65:d1:d0:c5:ee:5e:cd:b3:94:39Selection (1..2): 1$keyringgetsvcuser1password1$exportKEYRING_PROPERTY_SSH_KEY_FINGERPRINT=e8:19:fe:c5:0a:b4:57:5d:96:27:b3:e3:ec:ba:24:3c$keyringgetsvcuser2password2$pythonPython 3.6.8 (default, Jan 14 2019, 11:02:34)[GCC 8.0.1 20180414 (experimental) [trunk revision 259383]] on linuxType "help", "copyright", "credits" or "license" for more information.>>> import keyring>>> keyring.get_password('svc', 'user1')'password1'>>> keyring.get_password('svc', 'user2')'password2'Using with ansible-vaultIn this example we create a secret key in the keyring for use withansible-vault.
This process will work with any keyring backend, but it's assumed we are up and
running with thesagecipherkeyring backend per the previous section.For more information, see:https://docs.ansible.com/ansible/latest/user_guide/vault.htmlSet up environment variablesEnvironment VariableValueDescriptionPYTHON_KEYRING_BACKENDsagecipher.keyring.KeyringTellskeyringto use thesagecipherbackendKEYRING_PROPERTY_SSH_KEY_FINGERPRINT<hex fingerprint of ssh key>Pre-selects the SSH key for thesagecipherbackend to useANSIBLE_VAULT_PASSWORD_FILE<path to password script>ansible-vaultwill use this script to find the vault encryption keyReplace the key fingerprint below with your own.exportPYTHON_KEYRING_BACKEND=sagecipher.keyring.KeyringexportKEYRING_PROPERTY_SSH_KEY_FINGERPRINT=e8:19:fe:c5:0a:b4:57:5d:96:27:b3:e3:ec:ba:24:3cexportANSIBLE_VAULT_PASSWORD_FILE=~/vault-pass.shGenerate a random key for ansible-vault and store in the keyringkeyringsetansible-vaultkey<<(ddif=/dev/urandombs=32count=1|base64)Create the vault password script to retrieve the vault key$cat<<EOF>~/vault-pass.sh#!/bin/shkeyring get ansible-vault keyEOF$chmod+xvault-pass.shTest it out withansible-vault$ansible-vaultencrypt_string"secret_password"--name"secret_attribute">secrets.yml$ansiblelocalhost-mdebug-avar="secret_attribute"-e"@secrets.yml"[WARNING]: No inventory was parsed, only implicit localhost is availablelocalhost | SUCCESS => {"secret_attribute": "secret_password"}Using sagecipher directly in Python>>>fromsagecipherimportCipher>>>>>># Encrypts using the first SSH key available from SSH agent...>>>enc_text=Cipher.encrypt_string("hello, world")>>>text=Cipher.decrypt_string(enc_text)>>>text"hello, world"Using the sagecipher CLI toolChecksagecipher --helpfor usage. By default, the 'decrypt' operation will create a FIFO file, and then start a loop to decrypt out to the FIFO whenever it is opened.The FIFO is created with mode 600 by default, and if the permissions are altered or the parent shell is terminated then the sagecipher background session will end.$sagecipherencrypt-encfilePlease select from the following keys...[1] ssh-rsa e8:19:fe:c5:0a:b4:57:5d:96:27:b3:e3:ec:ba:24:3c[2] ssh-rsa 38:c5:94:45:ca:01:65:d1:d0:c5:ee:5e:cd:b3:94:39Selection (1..2): 1Reading from STDIN...secret sauce(CTRL-D)$sagecipherdecryptencfilesecret sauce$mkfifodecfile$sagecipherdecryptencfiledecfile&[1] 16753$catdecfile# decfile is just a FIFOsecret sauce$