I want to roll my personal cloud hosted Password Manager using pass. How secure/insecure would this be?

Question

I've come to the conclusion that I need to up my security. I currently have a dozen memorized passwords I use for every device and website. I'm against KeePass/Lastpass due to having to trust they haven't been compromised. Same goes for using an RSA Key.

My Idea of a Solution:

• I'd have a dedicated unix box (perhaps bsd, perhaps debian) hosted in my cloud. It would have gpg, pass, pwgen, and a ssh server.

• This box would only be accessible with the keyfile, and I'd generate a unique key for each client of mine. In case of a compromised device, I can revoke that key.

• I would generate passwords using pass, which generates, manages, and using a gpg key encrypts passwords.

• I would backup my password-store using git, rsync, or some sort of cron job to push the password-store through sftp, but a digital copy of my gpg key would never leave the server.

• I'd keep a copy of my gpg key as a qr code in a safety deposit box.

---

Does this seem like a working model or are there already holes? Am I in over my head trying to roll my own password management system?

Answer 1

You proposed method basically amounts to storing the cleartext passwords on a rented virtual machine, which is actually less secure than a normal password storage service, assuming it is properly implemented to perform all of the encryption on the client. Since the passwords are generated on that machine and the encryption key is stored on that machine, you are relying on the security of the machine, which means you are trusting the operator of the cloud service, and are also trusting that there won't be a vulnerability in SSH or some other network software you are running that allows an attacker to gain access to the machine. (Encrypting the passwords on the virtual machine doesn't accomplish much since the key is also stored there.)

Answer 2

ideally you'd encrypt the whole drive to prevent manipulation from local access. the following article lists some tips on how to protect local consoles:

• Tips To Protect Linux Servers Physical Console Access

but then you need some way to enter the the password/keyfile during boot-time, either via local acces or some kind of serial console; the perfect solution would be a box that only you have local access to.

in super-paranoid-mode you'd have some file-integrity-checker running like tripwire or ossec; i'd prefer tripwire, since you can store the check-database on a remote device.

there's more stuff you could do like a remote logserver and a NIDS like ossec, but this really depends on your level of paranoia and amount of worktime you want to dedicate to that project.

p.s.: this simple script, wrapped into gpg for de/encrypting during startup/shutdown might be a simple solution for a password-store; but pass looks a little more mature :)

Answer 3

If your primary reason not to use KeePass is that there is no cli interface, there actually is one: http://kpcli.sourceforge.net/

The source code (in perl) is (necessarily) available, so you can verify for yourself that it isn't compromised - I doubt that verification is any less secure than rolling your own.