Differences
This shows you the differences between two versions of the page.
— |
howto:desktop:encrypted-and-remotely-synced-password-list-with-zim-desktop-wiki-and-friends [2020-08-13 06:17] (current) |
||
---|---|---|---|
Line 1: | Line 1: | ||
+ | ~~META: | ||
+ | creator = Brendan Kidwell | ||
+ | &date created = 2008-10-23 | ||
+ | ~~ | ||
+ | {{tag> | ||
+ | ~~DISCUSSION~~ | ||
+ | ====== Encrypted and Remotely Synced Password List with Zim Desktop Wiki and Friends ====== | ||
+ | |||
+ | Passwords are problematic. This guide shows you how to manage a personal password list with multiple copies on different computers, synchronization among the computers, and encrypted storage. You'll need to be at least somewhat familiar with your system' | ||
+ | |||
+ | ===== 1. Introduction ===== | ||
+ | |||
+ | //**Note:** This guide uses Zim Desktop Wiki and encfs as two separate components. Shortly after I published it, a new version of Zim was released with new internal functionality to mount and unmount fuse filesystems such as encfs. I will probably update this guide in the future to relfect this, but in the mean time, if you are using version 0.27 or later of Zim, you may either follow my instructions exactly and ignore the fuse functions inside Zim, or use Zim's fuse mount/ | ||
+ | |||
+ | I'm lazy, and I don't want to memorize a bunch of different passwords for every online account I have. So, suppose I had one password that I used everywhere. This is incredibly insecure; if any one of my many accounts is compromised in a way that reveals the password, an attacker could then use that password to login anywhere else I have an account! | ||
+ | |||
+ | This is why most people have a handful of passwords, for example, one for Gmail, one for " | ||
+ | |||
+ | Clearly the safe thing to do is to **use a new, unique password for every new system account you setup**. And since you probably can't or don't want to memorize that many unique passwords, you're going to need a password manager program. | ||
+ | |||
+ | I've tried a few different password management programs over the last few years and none of them have really fit my needs. I used [[http:// | ||
+ | |||
+ | I like working in mobile, portable computing environments. I want to be able to see the some of the same files at home as I do on my work desktop. I want to be able to run applications remotely from home and have them display on my work desktop. And where speed is important (as is the case with looking up passwords in your password list), I keep distinct copies of the apps and data and synchronize them periodically. | ||
+ | |||
+ | I recently discovered [[http:// | ||
+ | |||
+ | I can't find one program to do everything I want, but it occurred to me that I could build the functionality I want out of smaller open-source components that already exist. Here are my requirements: | ||
+ | |||
+ | * A desktop-based account/ | ||
+ | * Must be able to synchronize separate copies of the data living on different computers. | ||
+ | * Data should be stored in plain text files or something else that's easy to manipulate and move data in and out of. Syncing is a lot easier with plain text files than with anything else | ||
+ | * Data must stored on disk in encrypted form | ||
+ | * The whole scheme has to work in Linux (my primary OS), Windows, and OS X. | ||
+ | |||
+ | One of the core rules of [[http:// | ||
+ | |||
+ | **Editor:** [[http:// | ||
+ | |||
+ | Note that another advantage of using Zim is that I don't really need access to Zim to casually browse and edit my passwords. With nothing but ssh and a text-mode terminal, I can log in remotely and retrieve a password. | ||
+ | |||
+ | **Synchronization: | ||
+ | |||
+ | **Encryption: | ||
+ | |||
+ | **Glue:** It's nice to have a few pieces of scripting glue code to tie this together so that, for example, I want a single command that will 1) check to see if the encrypted folder is mounted, 2) mount it if necessary, and 3) start Zim. I used the [[http:// | ||
+ | |||
+ | Here's how you put it all together: | ||
+ | |||
+ | ===== 2. Setup Zim Desktop Wiki ===== | ||
+ | |||
+ | Install [[http:// | ||
+ | |||
+ | - Use the <wrap nav>File -> Open Another Nokebook</ | ||
+ | - Use the <wrap nav> | ||
+ | - Set the name to "'' | ||
+ | |||
+ | Now add some new empty pages to your password wiki for your top-level categories. Here are some examples: | ||
+ | |||
+ | {{:: | ||
+ | |||
+ | If you have trouble figuring out how to create and navigate pages in Zim, hit [kbd]F1[/ | ||
+ | |||
+ | Now start entering all your passwords. Here is a concise format that I've arrived at with a little bit of experimentation: | ||
+ | |||
+ | {{:: | ||
+ | |||
+ | Each username/ | ||
+ | |||
+ | ===== 3. Encrypt Your Password Wiki ===== | ||
+ | |||
+ | When you're done loading all your passwords into your wiki, it's time to encrypt it. If you haven' | ||
+ | |||
+ | Now encrypt the folder: | ||
+ | |||
+ | <code bash> | ||
+ | cd ~/notes | ||
+ | mv enc-logins temp #put unencrtypted contents aside | ||
+ | encfs ~/ | ||
+ | # Follow prompts and set a passphrase (the master password to protect your stored passwords). | ||
+ | # enc-logins is now an encrypted folder, and it is mounted. | ||
+ | mv temp/* enc-logins | ||
+ | rm -r temp #remove leftover Zim index and temp folder itself | ||
+ | </ | ||
+ | |||
+ | Some clarification for those who are new to EncFS: | ||
+ | |||
+ | <wrap file> | ||
+ | |||
+ | <wrap file> | ||
+ | |||
+ | And a quick gotcha if you're unfamiliar with how unix mounts filesystems: | ||
+ | |||
+ | //I won't go into the details of setting up an encrypted folder with [[http:// | ||
+ | |||
+ | ===== 4. Create a Launch Script ===== | ||
+ | |||
+ | // | ||
+ | |||
+ | //This section is unix-specific. If anyone has a good solution for traslating these two scripts to a Windows environment with Zim + TrueCrypt, let me know and I'll post it here.// | ||
+ | |||
+ | Either install [[http:// | ||
+ | |||
+ | <code bash> | ||
+ | mkdir ~/bin | ||
+ | cd ~/bin | ||
+ | touch enc-logins | ||
+ | chmod +x enc-logins | ||
+ | nano enc-logins | ||
+ | </ | ||
+ | |||
+ | <file bash ~/ | ||
+ | # | ||
+ | |||
+ | # Mount ~/ | ||
+ | |||
+ | set data ~/ | ||
+ | set data_encrypted ~/ | ||
+ | set mount_name enc-logins | ||
+ | |||
+ | grep $mount_name / | ||
+ | set unmounted $status | ||
+ | |||
+ | if test $unmounted != 0 | ||
+ | Xdialog --title " | ||
+ | echo $password|encfs -S $data_encrypted $data | ||
+ | end | ||
+ | |||
+ | grep $mount_name / | ||
+ | set unmounted $status | ||
+ | |||
+ | if test $unmounted != 0 | ||
+ | Xdialog --title " | ||
+ | else | ||
+ | zim --no-daemon $data Home | ||
+ | end | ||
+ | </ | ||
+ | |||
+ | If you wish, create a launcher in your desktop' | ||
+ | |||
+ | You can also create a script to unmount the encrypted folder: | ||
+ | |||
+ | <file bash ~/ | ||
+ | # | ||
+ | |||
+ | # Unmount ~/ | ||
+ | |||
+ | set data ~/ | ||
+ | set mount_name enc-logins | ||
+ | |||
+ | fusermount -u $data | ||
+ | |||
+ | grep $mount_name / | ||
+ | set unmounted $status | ||
+ | |||
+ | if test $unmounted != 0 | ||
+ | Xdialog --title " | ||
+ | else | ||
+ | Xdialog --title " | ||
+ | end | ||
+ | </ | ||
+ | |||
+ | ===== 5. Setup Synchronization ===== | ||
+ | |||
+ | // | ||
+ | |||
+ | Install [[http:// | ||
+ | |||
+ | Create a Unison profile on the computer that will be initiating the connection: | ||
+ | |||
+ | <file ini ~/ | ||
+ | root = ~/ | ||
+ | root = ssh:// | ||
+ | </ | ||
+ | |||
+ | (Be sure to fill in '' | ||
+ | |||
+ | // | ||
+ | |||
+ | Before you run Unison, make sure the encrypted folders are **mounted** on both sides of the connection. (Alternatively, | ||
+ | |||
+ | {{:: | ||
+ | |||
+ | If you've edited files on both sides before syncing, Unison will register a conflict on the binary files in the <wrap file> | ||
+ | |||
+ | If Unison detects a conflict in any text files, that means you edited the same page on both sides of the connection. Use the Merge command to merge the new data from both copies into a new unified page. | ||
+ | |||
+ | Also, if you don't want to type your SSH password every time you run unison, learn [[http:// | ||
+ | |||
+ | ===== 6. Generating Passwords ===== | ||
+ | |||
+ | If you commit to using unique passwords every time you create new accounts, it quickly becomes obvious that creating new passwords is itself a small problem. (Mashing your hands on the keyboard is not the answer; it's not random enough.) Fortunately there is a solution to that, too. Install the package " | ||
+ | |||
+ | <code bash> | ||
+ | # long password: | ||
+ | apg -a1 -m19 -x19 -Msncl | ||
+ | |||
+ | # long alphanumeric only password: | ||
+ | apg -a1 -m19 -x19 -Mcnl | ||
+ | |||
+ | # short password: | ||
+ | apg -a1 -m8 -x8 -Msncl | ||
+ | |||
+ | # short alphanumeric only password: | ||
+ | apg -a1 -m8 -x8 -Mcnl | ||
+ | |||
+ | # pronounceable password: | ||
+ | apg -a0 | ||
+ | </ | ||
+ | |||
+ | Running the first of these commands on the command prompt generates a set of random 19 character passwords using letters, numbers, and symbols. The next three are variations on that theme. The last command generates an 8 to 10 character password made up of pronounceable syllables, which is easier to commit to memory. | ||
+ | |||
+ | Each time you assign a new password on a system, run apg with the most secure options you want to. Use shorter and alphanumeric-only variations when a stupid system requires that you don't use symbols or that your password be **shorter** than some length. (I've seen both restrictions.) Store the password in your wiki and also set your browser or other network client remember it. | ||
+ | |||
+ | You will probably have a small number of logins on systems that require you to type the password by hand every time. In this case, use the " | ||
+ | |||
+ | ===== 7. Backup Procedure ===== | ||
+ | |||
+ | Make sure your passwords folder is mounted, and simply use your favorite archiving program (Zip, 7-Zip, RAR, etc.) to create an archive of the folder, encrypted with a password. In a disaster recovery situation, all you need to read this backup is the archive program and a text editor. | ||
+ | |||
+ | Store your backup at a **different physical location**. House fires and other such disasters are traumatic enough, and you don't want to get locked out of your entire online life and feel even worse! | ||
+ | |||
+ | ===== 8. Best Practices ===== | ||
+ | |||
+ | - **Always** create a new unique password every time you create a new account on any system. | ||
+ | - Use a random password generator to get the most random password you can. Anything you come up with in your head will be less random and less secure than the output of a random number generator. | ||
+ | - Change passwords on sensitive accounts regularly. | ||
+ | - Don't share your passwords with your friends. If you're forced to share one, change it later. | ||
+ | - Don't share your passwords with other web sites! Yes, Facebook might have a legitimate need to see my Gmail address book so it can instantly determine who I know that's already on Facebook, but allowing Facebook to login to my Gmail account with complete access is absolutely not an acceptable way to grant this request. | ||
+ | - Don't share your passwords. | ||
+ | - Lock your passwords folder by unmounting it, when you're not using it. | ||
+ | - Back up your passwords folder regularly to a **different physical location**. | ||
+ | - Save your passwords in your web browsers and other desktop apps, but be aware of the security ramifications. Safari and Konqueror store web site passwords in a database encrypted with a key you choose. Firefox and Opera do not let you choose the key, and they are quite vulnerable to a physical attack on your computer. | ||
+ | - Don't use passwords. :^) In some instances where they might be available, you might find other schemes like public key authentication to be more convenient or more secure. | ||
+ | |||
+ | Bonus: If a system forces you to answer a " | ||