Several of the command line applications require the ability to interact with passwords.
Note: See the parent document: Using the Terminal as a Daily Driver for more about terminal productivity applications.
Pass
Also known as password-store, the standard UNIX password manager.
In this case, reading the homepage is a must. Also, check out this video which walks you through most of the things documented on the homepage.
Setting it up by using GPG.
# you will need a gpg key pair.
gpg --gen-key
GnuPG will need to construct your user ID to identify your key Real name: xxxxx Email Address: xxxxx@yyyyy.zzz
After entering this information, you will be prompted for a passphrase. This will be the master password for this key. So, it will need to be something memorable. You will have to enter it twice.
Once finished with generating the GPG key pair, it will spit out the id the key pair.
# retrieve the id.
gpg -K
# Want to change the expiration date.
gpg --edit-key [40 char id]
# run the 'expire' command within gpg to change the date.
# after making your expiration date changes,
# run the 'save' command to save and exit gpg.
Initializing pass
You will need the big long id from the GPG setup in order to initialize pass to store your passwords.
# initialize the password store
pass init [40 char id]
# creates a git repository for versioning out password data.
pass git init
At this point, the hard part of setting up pass is done. Now we can begin adding passwords to it.
Adding passwords to pass
Since password-store is a file based system, we can use a folder (category) to organize our passwords. The category is not required, but it will make keeping everything organized much easier in the long run.
# create a new password, prompting you for the password value.
pass insert [category]/[title]
# example: pass insert email/google
# pass insert email/yahoo
# pass insert email/outlook
# If you want to just generate a new password use:
pass generate [category]/[title]
Adding additional metadata
You can launch a text editor and add additional metadata to the password file using the following command:
bash edit [category]/[title]
The first line of the file is the password. Metadata fields can be added on subsequent lines. Here are some metadata suggestions:
username: xxxxx@yyyyy.zzz website: https://www.mysite.com secret-1: my mother’s maiden name secret-2: my first pet pin: 1234 note: here is a note
You can also use the following commands to search your password collection.
# search for a certain term
pass find [search term]
# example: pass find google
# search within metadata
pass grep [search term]
# example: pass grep bob@example.com
Retrieving Passwords
There are several ways to display your passwords
# print to screen
pass show email/google
# copy to system clipboard with the -c option.
pass show -c email/google
# print out the clipboard contents as a proof of concept.
xclip -o -sel clip
Managing passwords
Passwords can be removed with the rm option. There are also commands to move mv and copy cp passwords to different folders.
pass rm email/google
The other cool thing about pass is that it interfaces with git (we created a git repo earlier). This means that you can create a remote repository
# for example, add a remote repository on github
pass git remote add origin git@github.com:myname/password-store.git
# Then push the password repository to github.
pass git push origin main
This means you can go to another machine and clone your password store. But first, you will need to copy your GPG keys to this machine as well.
# On primary computer
mkdir key-export
cd key-export
# export the public and private keys.
gpg --output public.pgp --armor --export [id | email ]
# email may be easier than id
gpg --output private.pgp --armor --export-secret-key [id | email]
# the public and private keys will need to be copied to the 2nd machine.
# Your copy method goes here.
# Once copied, you will import them into gpg on the new machine.
# Do the private on first. When prompted for the password, it will be that same as on the primary machine.
gpg --import private.pgp
# and now import the public key.
gpg --import public.pgp
# clone the repo into ~/.password-store
git clone git@github.com:myname/password-store.git .password-store
# If all went well, running a pass show command with reveal the info.
pass show email/google
# One more thing... you will have to bump the trust level of the imported keys with the trust command.
gpg --edit-key [id | email ]
gpg> trust
# Set the trust to level 5 = I trust ultimately
gpg> save
# Whew, boy are my fingers tired.