Using Password Store
Password Store (aka “pass”) is a very handy wrapper for dealing with pgp encrypted secrets. It greatly simplifies securely working with multiple secrets. This is still true even if you happen to keep your encrypted secrets in non-password-store managed repositories, although that setup isn’t covered in the docs. I’ll show my setup here. (See the Password Store page for usage: “pass show -c <spam>” & “pass search <eggs>” are among my favorites.)
- Short version:
Have gpg installed on your machine.
Install Password Store on your machine. There are OS specific instructions. Be sure to enable tab completion for your shell!
Setup a local password store. Scroll down in the usage section to “Setting it up” for instructions.
Clone your secrets repositories to your normal location. Do not clone inside of ~/.password-store/.
Set up symlinks inside of ~/.password-store/ to directories inside your clone of the secrets repository. I did:
ln -s ~/path/to/secrets-git/passwords rePasswords ln -s ~/path/to/secrets-git/keys reKeys
Enjoy command line search and retrieval of all your secrets. (Use the regular method for your separate secrets repository to add and update secrets.)
Rationale:
- By using symlinks, pass will not allow me to create or update secrets in the other repositories. That prevents mistakes, as the process is different for each of those alternate stores.
- I prefer to have just one tree of secrets to search, rather than the “multiple configuration” approach documented on the Password Store site.
- By using symlinks, I can control the global namespace, and use names that make sense to me.
- I’ve migrated from using KeePassX to using pass for my personal secret management. That is my “main” password-store setup (backed by a git repo).
Notes:
- If you’d prefer a GUI, there’s qtpass which also works with the above setup.