Storing passwords securely using Pass (GPG)
Today we live in an endless sea of passwords, which are a very inefficient and ineffective means of securing our data & environments. Many companies are trying to solve this problem using a variety of techniques that all revolve around various forms of multi-factor authentication.
However, in the mean time were all screwed 😉
Just kidding. Quick PSA though, use two factor authentication at a minimum everywhere you can ESPECIALLY your email, since it’s used for password recovery on other sites. Ok then moving on…
There are many password managers like LastPass and 1Password, which do a fairly effective job at providing convenience and prevent you from scribbling down your passwords on paper (STOP IT !!!). However, I personally can’t get passed the whole ‘store all my passwords in one super secure vault on the Internet’ thing. To be fair some of these password managers can be downloaded on your machine and ran locally, but there are two other drawbacks to those I found.
- Some of them are not free and…
- Some of them have ugly and clunky UI’s
So what do I like/use then ? I use something called ‘pass’. Which is a command line utility that wraps GPG. The reason I use it is because…
- I love using command line utilities over GUI, I find it far more convenient and…
- I was going to write this exact utility (a GPG wrapper) until I found out someone else did and…
- Because I like GPG.
At most of the organizations I have worked at, password management was done poorly i.e. everyone used different approaches and there was no governance or oversight. I hope with this article to make folks aware of what I feel is a simple, effective method that every unix savvy administrator should use.
FYI Pass provides migration scripts from the most popular password manager tools on their website.
Introducing Pass
From the Pass site “Password management should be simple and follow Unix philosophy. With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password. These encrypted files may be organized into meaningful folder hierarchies, copied from computer to computer, and, in general, manipulated using standard command line file management utilities.”
Where Can You Get or Learn More About Pass ?
https://www.passwordstore.org/
Installing Pass
Depending on your operating system there are various ways to install
Ubuntu/Debian
sudo apt-get install pass
Fedora / RHEL
sudo yum install pass
Mac
brew install pass echo "source /usr/local/etc/bash_completion.d/password-store" >> ~/.bashrc
Since I already installed pass on my Mac a while back I will be installing it on a Docker container with Ubuntu 16.04.
root@0b415380eb80:/# apt-get install -y pass
After pass successfully installs, try running it
root@0b415380eb80:/# pass Error: password store is empty. Try "pass init". root@0b415380eb80:/#
Well that is pretty straight forward, it appears we need to initiliaze the db.
root@0b415380eb80:/# pass init Usage: pass init [--path=subfolder,-p subfolder] gpg-id... root@0b415380eb80:/#
Looks like we need to provide ‘key’…can that be just anything?
root@0b415380eb80:/# pass init "tuxlabs Password Key" mkdir: created directory '/root/.password-store/' Password store initialized for tuxlabs Password Key root@0b415380eb80:/# pass Password Store root@0b415380eb80:/#
Now our password store looks initialized ! Let’s try inserting a password into the DB !
root@0b415380eb80:/# pass insert Gmail/myemail mkdir: created directory '/root/.password-store/Gmail' Enter password for Gmail/myemail: Retype password for Gmail/myemail: gpg: tuxlabs Password Key: skipped: No public key gpg: [stdin]: encryption failed: No public key root@0b415380eb80:/#
Uh oh what happened ? Well remember I said it uses GPG, and we not only don’t have a gpg key setup in our Docker container, but we initialized our Pass DB without using a GPG Key (the whole point) !
root@0b415380eb80:/# gpg --list-keys root@0b415380eb80:/#
To remedy this we need to create a GPG key
Creating your GPG Key
root@0b415380eb80:/# gpg --gen-key
gpg (GnuPG) 1.4.20; Copyright (C) 2015 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Please select what kind of key you want:
(1) RSA and RSA (default)
(2) DSA and Elgamal
(3) DSA (sign only)
(4) RSA (sign only)
Your selection? 1
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0)
Key does not expire at all
Is this correct? (y/N) y
You need a user ID to identify your key; the software constructs the user ID
from the Real Name, Comment and Email Address in this form:
"Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"
Real name: Tuxninja
Email address: tuxninja@tuxlabs.com
Comment: TuxLabs
You selected this USER-ID:
"Tuxninja (TuxLabs) <tuxninja@tuxlabs.com>"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
You need a Passphrase to protect your secret key.
gpg: gpg-agent is not available in this session
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
............+++++
...................+++++
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
...+++++
+++++
gpg: key 5B2F89A5 marked as ultimately trusted
public and secret key created and signed.
gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u
pub 4096R/5B2F89A5 2016-12-14
Key fingerprint = 5FF6 1717 4415 03FF D455 7516 CF8E 1BDC 5B2F 89A5
uid Tuxninja (TuxLabs) <tuxninja@tuxlabs.com>
sub 4096R/EF0F232F 2016-12-14
root@0b415380eb80:/#
To view your GPG key run
root@0b415380eb80:/# gpg --list-keys /root/.gnupg/pubring.gpg ------------------------ pub 4096R/5B2F89A5 2016-12-14 uid Tuxninja (TuxLabs) <tuxninja@tuxlabs.com> sub 4096R/EF0F232F 2016-12-14 root@0b415380eb80:/#
Now we can see we have one GPG key, with the ID 5B2F89A5
Let’s try re-initializing Pass.
root@0b415380eb80:/# pass init "5B2F89A5" Password store initialized for 5B2F89A5 root@0b415380eb80:/#
But we have a problem, re-initializing Pass doesn’t get rid of our previous insert into the db. As you can see here our Pass DB is effectively corrupt.
root@0b415380eb80:~# pass Password Store `-- Gmail root@0b415380eb80:~# pass rm Gmail Are you sure you would like to delete Gmail? [y/N] y rm: cannot remove '/root/.password-store/Gmail': Is a directory root@0b415380eb80:~# pass rm Gmail/myemail Error: Gmail/myemail is not in the password store. root@0b415380eb80:~#
Hmmm, what’s a guy to do….
root@0b415380eb80:~# rm -rf .password-store/Gmail/ root@0b415380eb80:~# pass Password Store root@0b415380eb80:~#
Yes it really was that simple, and that is one more reason why I love pass.
You can also initialize your password store using git for version control, see the passwordstore.org website for more info !
Now let’s insert some good stuff.
Inserting A Password into Pass
root@0b415380eb80:~# pass insert Gmail/myemail
Enter password for Gmail/myemail:
Retype password for Gmail/myemail:
root@0b415380eb80:~# pass
Password Store
`-- Gmail
`-- myemail
root@0b415380eb80:~#
That seems to have worked. Let’s try to retrieve the pass.
Retrieving A Password In Pass
root@0b415380eb80:~# pass Gmail/myemail gpg: starting migration from earlier GnuPG versions gpg: porting secret keys from '/root/.gnupg/secring.gpg' to gpg-agent gpg: migration succeeded testpass root@0b415380eb80:~# pass Gmail/myemail testpass root@0b415380eb80:~#
Note, I retrieve the password twice using my GPG Passsword (You will be prompted through a curses interface to enter your passphrase). Then I run it again, because of the initial GPG migration messages just to show how it would normally work after you’ve used GPG once with Pass.
Now let’s say someone is standing over your shoulder, you want to access your passsword, but you don’t want them to see it. You can get it straight to your clipboard by using -c.
Copying Passwords To Your Clipboard
pass -c Gmail/myemail Copied Gmail/myemail to clipboard. Will clear in 45 seconds.
Docker Issue ?
Notice the prompt is not included in the above example ? That is cause it didn’t actually work. Apparently, it doesn’t work in Docker due to not having display dependencies installed/configured. So what I show above is the output from my mac…but my actual Docker related error was.
root@0b415380eb80:~# pass -c Gmail/myemail Error: Can't open display: (null) Error: Could not copy data to the clipboard root@0b415380eb80:~#
There might be an easy way to fix this (like install X), but I don’t usually use Docker for storing my passwords I just happen to be using it for this tutorial, so moving on !
Folders
It’s also important to note that Pass supports folder structures, as shown in my example I am creating a ‘Gmail’ folder and placing a password file called ‘myemail’ with my password in it. In reality I recommend not naming the file after your account/email and using the multiline version to encrypt those details as well. That way you can just stick to the site name for the name of the encrypted file in whatever folder or in the top level of Pass.
Multiline Encrypted Files with Pass
A common use case with Pass is adding an entire encrypted file so you can store more than just a password…
root@0b415380eb80:~# pass insert -m tuxlabs/databases
mkdir: created directory '/root/.password-store/tuxlabs'
Enter contents of tuxlabs/databases and press Ctrl+D when finished:
this is an example of a multiline
encrypted file
this way you can store more than just a password you can store user/pass/url etc
root@0b415380eb80:~# pass
Password Store
|-- Gmail
| `-- myemail
`-- tuxlabs
`-- databases
root@0b415380eb80:~#
Again retrieving it is as easy as..
root@0b415380eb80:~# pass tuxlabs/databases this is an example of a multiline encrypted file this way you can store more than just a password you can store user/pass/url etc root@0b415380eb80:~#
Finally if you no longer want the info to be stored in Pass…
If you want to copy you password to the clipboard from a multiline file, you must store your password on the first line of the file !
Deleting An Entry In Pass
root@0b415380eb80:~# pass rm Gmail/myemail Are you sure you would like to delete Gmail/myemail? [y/N] y removed '/root/.password-store/Gmail/myemail.gpg' root@0b415380eb80:~# pass rm tuxlabs/databases Are you sure you would like to delete tuxlabs/databases? [y/N] y removed '/root/.password-store/tuxlabs/databases.gpg' root@0b415380eb80:~# pass Password Store root@0b415380eb80:~#
Another thing, the output on my mac is much prettier than this `– thing I am getting in the Ubuntu Docker container… Not sure if that’s an Ubuntu issue or Docker, but on the Mac the output is much prettier, which can be seen on the passwordstore.org home page.
So that’s it, Pass is pretty straight forward, easy to work with, depends on GPG security and that is why I like it.
Stay secure, until next time !
Storing passwords securely using Pass (GPG) Read More »