1

I want to set up a password management system on a home machine running Debian, and for this I'm considering only non-proprietary, open source password-managers available through Debian1.

I'd like to make the master password, or rather, passphrase, to the password-managing application very long2. In fact, I want to make it much longer than I'd want to have to type every single time I need access to the password database (which is usually several times per login session).

Is there some way to limit the number of times I need to type the long passphrase to just once per login session?

I'm thinking of an "agent" application analogous to ssh-agent, but one that talks to the password-managing application rather than to the ssh client. IOW, I want to be able to delegate to this agent application the authentication requests from the password-managing app every time I need access to its database (i.e., not only when I'm required to respond to an authentication challenge from some remote sshd).

1I know of two such packages, keepassx and pass; please let me know of any others.

2As I understand it, all password-managing applications require typing a master password to gain access to the password store. A risk inherent in such a scheme is that, if the master password gets cracked, then the attacker gains a stash of passwords with one blow. Therefore, it is essential that the master password be as secure as possible, and hence the long passphrase business.

4

3 Answers 3

1

You've limited yourself quite a bit to only KeepassX and pass, but you can keep KeepassX open all day long and set it to not lock. Then you only need to unlock it when you login, but won't need to unlock it again. This is essentially what ssh-agent does for ssh keys (keeping credentials in-memory after unlocking once).

1

What is it about GNOME Keyring Manager or Kwallet that doesn't meet your needs?

Also if you're interested in having your own apps use an overlay to store their passwords inside your desktop environment's keyring, using a portable API (e.g. PPassKeeper) might be useful.

0

You do not have to 'roll your own': LastPass does exactly that: Once you've typed in the master password to open your vault, it stays open for the time you configured.

You need the paid Lastpass premium edition for the LastPass Sesame (Ubuntu/Debian) version.

You can have a master password of up to 255 characters.

2
  • 1
    My apologies: the wording of my original post was not clear enough. I have edited it to clarify that I'm considering only non-proprietary, open source password-managers available through Debian. AFAICT, Debian does not distribute any form of LastPass.
    – kjo
    Jun 26, 2014 at 13:46
  • 1
    You can also add multifactor security in addition to your master password. So you enter it once per session, and also have to MFA with your option of a hardware or google auth token. I looked around for a bit, and lastpass is lightyears ahead of the pack in terms of cross-platform support. Jun 26, 2014 at 13:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .