Provide password cache for keepassxc-cli

[azzamsa]

Expected Behavior

keepassxc-cli should have password cache, that similar to github password cache in git

Current Behavior

keepassxc-cli always prompt user a password in every operation

Possible Solution

implement it :)

Debug Info

KeePassXC - Version 2.2.4
Revision: 4723f66

Libraries:

• Qt 5.7.1
• libgcrypt 1.7.6-beta

Operating system: Debian GNU/Linux 9 (stretch)
CPU architecture: x86_64
Kernel: linux 4.9.0-4-amd64

Enabled extensions:

• KeePassHTTP
• Auto-Type
• YubiKey

[laur89]

Agreed; could keepassxc-cli communicate with client, if running, to ask for authentication status.

Additionally it'd be great if it defaults to whatever database currently loaded in keepassxc client, eg we could do

keepassxc-cli locate mysearch

instead of current

keepassxc-cli locate /path/to/my_db.kdbx mysearch

[TheZ3ro]

with this the cli interface will depend on the gui client, right now the cli interface is pure cli that works standalone (can work without the gui installed)

[droidmonkey]

This is where the keyring integration would be nice

[wohali]

Except that keyring integration is not available on all platforms, and not necessarily desired (especially on Windows).

Yes, I'd love to see the CLI client (or an alternative CLI client) have a mode that is similar to the browser plugin, where you auth it every X minutes and it can query for passwords on demand.

[sjamesr]

Maybe you can use the open command now, this will give you an interactive session where you can issue multiple commands on the same database without giving a password each time.

[wohali]

@sjamesr Hrm, I'd have to use an expect script to automate this, and I'd have to have a background process running all the time with the open command running in it, and have some sort of RPC mechanism. Sounds bad.

Let me explain my use case: the idea is to provide scripting for my employees. They have a keepassxc database with some corporate passwords in them to access machines. I want them to be able to ssh to various machines in our infrastructure without being prompted. This could be for provisioning, or port forwarding, or other needs. A 3 or 4 line shell script should be all this needs, but right now I can't do this with keepassxc-cli at all.

[droidmonkey]

Please expand your description of your use case because I don't understand how you can have no prompt at all for your workers. At some point someone needs to unlock the database. Where/when does that occur in your use case?

[wohali]

@droidmonkey If keepassxc is unlocked on their laptop already, then the CLI should be able to connect to that and retrieve the credentials. If it's not unlocked, it would prompt for a password.

[droidmonkey]

Gotcha perfect. I think we can abuse the browser proxy for this purpose.

[raphaelahrens]

Hi,
there is a tool which seems to do what you describe here, at least for git.
git-credential-keepassxc

[meersjo]

Perhaps a little off-topic; but I'd like a similar enter-password-once feature for use in scripting and automation; and I was thinking more along the lines of the sshpass tool that can pick up the password out of an envvar, for instance.

The actual sshpass tool does not work with keepass, alas :-)

[rumpelsepp]

The open command exists for caching purposes. But it is kind of useless for usecases like mutt or backupscripts where stdin in blocked.

[dburton90]

Oh man, I wish I saw @raphaelahrens post before this weekend :). I could save some time :D. I also created something to be able to use keepassc in scripts. It is wrapper around keepassxc-cli open. Something similar to what @wohali suggested and considered it as bad idea :). Nevermind, if someone would be interested you can find it here: Keepassxc-cli WRAPPER

[michaelk83]

For those interested, on Linux, with FdoSecrets integration enabled, you can use secret-tool or the libsecret python bindings for some automation and scripting tasks against the KPXC GUI. The user unlocks once via the GUI, and DB will remain unlocked until locked by the user or auto-locked by KPXC - usually long enough for the script to complete. The DBus interface provides some complementary unlocking and locking commands.

edit: If you set up a separate DB for it, that can also work as a password cache (similar to gnome keyring). But keepassxc-cli will need to implement an FdoSecrets client to use it (e.g. via libsecret).

[wohali]

@michaelk83 the system I need this working on is running without X.

[michaelk83]

the system I need this working on is running without X.

If we're still talking Linux, the GUI won't run without X (or Wayland), so the CLI won't have anything to connect to. Then this scenario won't be possible either:

If keepassxc is unlocked on their laptop already, then the CLI should be able to connect to that and retrieve the credentials. If it's not unlocked, it would prompt for a password.

But on a typical user's laptop, there should still be a desktop environment of some sort. This scenario is exactly what the FdoSecrets + libsecret can do.

FdoSecrets itself doesn't need a desktop, just DBus. So when the GUI is separated from the core, this should work on a server as well (see #5717). But that's still a while away. The DB can be unlocked via KPXC's native DBus interface, so no GUI is needed for that either.

On Windows, this might work under WSL. Otherwise, a minimal Linux in a VM might do the trick, if you're willing to mess with that.

[droidmonkey]

We won't implement this beyond what is provided by using the open command.