This article covers UNIX Password Manager (pass) Cheat Sheet and Getting Started Guide, originally published as a secure GitHub Gist snippet.

pass cheat sheet/guide

Getting started guide to the unix password manager pass. Manage gpg encripted passwords (files) in a standar directory-like hierarchy. Such files can be copied or stored in a git repository.

Requirements

  • Install pass (standard unix password manager):

Ubuntu/Debian:

$ sudo apt-get install pass

Others platforms.

  • Install pass-otp (pass plugin) to support two-factor-auth logins:

Ubuntu/Debian:

$ sudo apt-get install pass-extension-otp

Other platforms.

Initialization or re-initialization (re-encryption of passwords)

pass expects to find all the password databases under the folder ~/.password-store. So there should be a folder per password database.

This is to first create the password database with your own credentials:

$ pass init -p Note: Please notice that the <pass-db-folder> is or could be a git repo root folder so you can store the DB in a Git repository.

When adding a new team member the re-encrypting of all the passwords is required. To re-encrypt you must first include the new member's public key id on the file ~/.password-store/<pass-db-folder>/.gpg-id.

Let's assume I want to grant John Doe with access to the passwords database. The contents of the ~/.password-store/pass-infra/.gpg-id should be:

me@secret.io
jdoe@secret.io

Now we can re-encrypt/re-initialize the password database with the command:

$ pass init -p $(cat ~/.password-store//.gpg-id) Following the example the command should be:

$ pass init -p pass-infra $(cat ~/.password-store/pass-infra/.gpg-id)

Git repos

pass isn't yet ready to work with multiple password repositories so to push local changes to the corresponding Git repo you must do it manually by going to the password database subfolder and doing a git push.

Following our previous example, we should do:

$ cd ~/.password-store/pass-infra $ git push

pass cmd reference

Store

Generate

$ pass generate [-n] To generate a password with a specific length. To not include symbols you can use -n.

Insert

$ pass insert [-m] To insert a password from standard input. With -m multi-line is enabled so it reads until EOL or Ctrl+D is reached.

Retrieve

List

$ pass [ls] [pass-subpath] To print a tree-like list of accounts starting from the pass-path (if given).

Fetch

$ pass [show] [-c] To print fetch/print a specific pass. Use -c to copy it (temporarily) to the clipboard instead of printing it to standard output.

Note: some commmands like ls or show are optional because the is no need to explicitly specifying them to get the same action executed.

Management

Move

$ pass mv

Copy

$ pass cp

Delete

$ pass rm [-rf] | To delete a specific password or a set of passwords (under the same subfolder).

Edit

$ pass edit It can be also used to create a password instead of insert.

OTP

$ pass otp [-c] To fetch the otp.

GPG intro

Creating a pair of keys

$ gpg --full-gen-key Select the RSA and RSA key with a length of 4096 bits.

Exporting public key

gpg --armor --export > mypkey.asc

Importing a public key

gpg --import mypkey.asc After importing a public key it must be signed (trusted) so it can be used to encrypt passwords:

$ gpg --edit-key .... gpg> lsign .... Really sign? (y/N) y

gpg> save

References

  • Using pass in a team.
  • Creating GPG keys.
  • Pass cheatsheet.