Open Source ERP Academy

Passwords, Credentials, Authentication and Secrets Primer

The purpose of this page is to record options and best practices for managing passwords, credentials, authentication and secrets.

Your goal is to maximize security and simplicity. Choose the platform that works everywhere, consistently regardless of the application (desktop, latptop, phone, server, platform, etc...).

Problem statement: You need access to password everywhere (desktop, laptop, phone, server), and you need the right people who have the right projects to have access to the right passwords. You need them secure. You need to be able to update them from anywhere, and you need changes distributed everywhere. You need them to work across multiple platforms such as Docker, Incus, Proxmox, AWS, Linode, Nix, Debian, etc… And, you cannot spend a fortune in tooling or time…

Age/Rage Primer

Age is popular go-based cli to encryption tool. Here is a quick summary. Rage is a rust-based re-write. Everywhere you see "age" below, you can replace with "rage". Example "rage-keygen".

Create a key:

age-keygen -o ~/.ssh/age-key

Notice that the public key will be printed to the screen. I will refer to this key below as "printed-key".

Create a public key file for reference if needed (similar to id_rsa.pub)

echo "printed-key" > ~/.ssh/age-key.pub

Also consider adding your public key in ~/.bashrc. Example:

AGE_KEY_PUB="printed-key"

Here as some examples of encrypting:

tar cvz ~/data | age -r "printed-key" > data.tar.gz.age
age -r $AGE_KEY_PUB zram.txt > zram.txt.age

Here is an example of decrypting (put to a different file name to prevent overwriting the original):

age -d -i ~/.ssh/age-key zram.txt.age > zram.txt.decrypted

References:

All the below documentation is related to gpg and pass (password-store). Age is a newer concept and does not rely on pre-existing configuration.

GPG Primer

References:

Pass (Linux CLI password-store)

Summary: pass is a linux cli password manager/store is the best option for the above goal. It is backed by git, and it has read/write clients on just about very major platform.

References:

Pass Quick Reference

Add Additional Key to Existing Password Store

There are times when you need to add an additional key to an existing password store. Here is the command:

pass init [original-key-id] [your-new-key-id]

Using pass from Inside Source Env File

There are times when you need to include an environment variable file in a repository. Below is an example of how to create your environment variable file so that I can read from a .password-store in the same directory (not the user's home directory).

? cat publisher.env
 PUB_HOST="localhost"
 PUB_PORT="5432"
 PUB_DB="idempiere"
 PUB_SCHEMA="adempiere"
 PUB_ADMIN="adempiere"
 PUB_USER="bi_subscriber"
 PUB_PASSWORD_STORE_DIR=$(pwd)/.password-store/
 PUB_PASSWORD=$(PASSWORD_STORE_DIR=$PUB_PASSWORD_STORE_DIR pass bi_subscriber/pub-password)

Bash Functions for Quick Lookup

The following aliases and functions can be added to your .bashrc to make pass much easier to use. Note that I have not figured out a way to enable bash completions for functions/aliases for pass.

For the complete current commands, go here. Below is an example.

# pass find
alias pf='pass find'
# pass quick copy
function p() {
    pass -c $1
}
# pass quick copy from local password store in current directory
function pl() {
    PASSWORD_STORE_DIR=$(pwd)/.password-store/ pass -c $1
}

Troubleshooting

gpg Defaults

Set the default password timeout to 1 hour (3600 seconds):

gpg Timeout on Lock Screen

See chuboe-system-configurator => gpg-timeout.sh

Access from a Server, Container or Docker

Pass does not behave well inside a container if you are using a key with a password. The normal use case will result in of the following errors errors:

If you are not happy with the above solution, you can simply decript the password manually using the this command after gpg is configured and your private key is imported (just like normal pass operations):

It is a little bit of a bummer that pass does not magically work everywhere; however, I am not too concerned. The only thing you do on a server is decrypt. It is just as easy to use gpg in that case anyway.

Migrating from Another App to Pass

Passforios (IOS app)

The purpose of this section is to discuss how to get up and running with the apple iphone ios app (passforios).

Other Pass GUI Apps

On my desktop/laptop, I do not use a gui for pass. Instead, I simply press "super+t" to get a terminal and execute my pass command to get a password. I do the same for many other tools as well (example: buku bookmarks). I can appreciate that not everyone is comfortable with the terminal, and others might simply prefer a gui. Below are notable gui tools for pass.

Backing up Pass

If you have git enabled and set to push regularly, the contents of pass are backed up using git; however, be aware that you need to backup the contents of gpg (~/.gnupg). Note that I updated the chuboe-system-configurator => sync-backup.sh to include "BU_PRIVATE[gpg]=~/.gnupg" as one of the directories that gets sent to rsync.net. I also included "BU_PRIVATE[password-store]=~/.password-store" for good measure and redundancy.

Pass Reviews and Discussions

Here are some interesting reviews and discussions:

Other Password Clients

KeepassXC (for linux desktop) is a good option; however, it has poor options for integrating with other desktops/phones. It does not have a good multi-master option (where the above pass uses git as its underlying merge/control platform).

Authy is another that has been recommended that can run on multiple platforms.