Password management with ccrypt

Intro
Server
Client(s)
About ccrypt

For the past few years, the list of passwords I use for all the various websites, servers, and applications has been growing ever longer. Some people limit themselves to 3-4 passwords, or a handful of formulas for password generation. I used to do that, but it's insecure, and when you control the fate of numerous servers, it's irresponsible. These day, I generally create new passwords at random, and replace them every 3-4 months.

Every flavour of linux has its own system for managing passwords; for example, KDE has KWallet; Gnome has Keyring. Tuesday I started playing with Fedora for the first time in years, and discovered yet another way: System > Preferences > System > Authorizations (polkit-gnome-authorization). And, of course, even Mozilla (Firefox, Thunderbird) handles password management like this... but each application has its own repository, and each one will get out of sync in time.

So, for a password management system that doesn't care about window manager, application, or even OS (this works with under cygwin on Windows, too), I've designed my own method.

How do you remember 100s of passwords which have nothing in common? Store them in a database, encrypted by a passphrase/password, then use a simple query engine to retrieve them.

Here's how it works, and how you can set up something similar.

Home Server / CVS Server

First, define these 3 scripts.

1. /home/user/passwds/PWget.sh

#!/bin/bash
dir=/home/user/passwds;
mkdir -p $dir;
echo -n "Retrieve latest? [y/N] "; read yn;
if [[ $yn == "y" ]]; then
 scp user@home-server:$dir/passwds.cpt $dir
fi

2. /home/user/passwds/PWsearch.sh

#!/bin/bash
file="/home/user/passwds/passwds.cpt";
ccrypt -c $file | grep -i "$1";

3. /home/user/passwds/PWedit.sh

#!/bin/bash
file="/home/user/passwds/passwds";
ccrypt -d $file.cpt; vi $file; ccrypt -e $file

Next, define 2 aliases -- one for password lookup, and one to modify the encrypted password file. I use ~/.alias, which I load as part of my ~/.bashrc file.

4. /home/user/.alias

alias PW='/home/user/passwds/PWsearch.sh $1'
alias PWE='~/PWDs/PWedit.sh'

Now, on the home server, I can run `PW eclipse` to decrypt the file, look up any lines in the password file with "eclipse" in them, and return those entries to me. Or, I can run `PW | more` by itself to display the entire file (paged with `more`). To modify the file, I use `PWE` to decrypt, edit, and re-encrypt the file. I also periodically save this file into my CVS repository (cvs add -kb passwds.cpt; cvs ci -m "" passwds.cpt) so I can track changes.

Remote Client(s) / Other Servers

Well, you think, that's great for a single system, but I need my passwords on 3 or 4 different systems. Plus, my home server may or may not always be accessible (eg., only when I'm on my home network).

So, once again, we start with the same three bash scripts.

Next, define a different version of the `PW` alias:

5. /home/user/.alias

alias PW='/home/user/passwds/PWget.sh;/home/user/passwds/PWsearch.sh $1'

Now, on any other server which can reach the home server over ssh, `PW eclipse` can be used to (optionally) retrieve the latest version of the password file, then search it as in the example above. Can't reach the home server? That's fine, we keep a local cache of the encrypted password file -- good enough until the next synch.

Voila! Centralized encrypted password management for Windows & Linux clients!

About ccrypt

So, what handles the encryption, and how secure is it?

ccrypt is based on the Rijndael block cipher, which was also chosen by the U.S. government as the Advanced Encryption Standard (AES, see http://www.nist.gov/aes/). This cipher is believed to provide very strong cryptographic security.

-- ccrypt 1.7 man page

 

If your linux or cygwin distro doesn't include ccrypt in its repositories, here are a couple places you can find it:

• ccrypt 1.7 (Fedora/SUSE .rpm, Debian/Ubuntu .deb)
• ccrypt 1.7 (cygwin .exe)

Password Reset Hell

My Notes password expired on the weekend. November 11th, in fact. Apparently the 'lest we forget' messages about WWI and WWII this weekend made me forget about the triviality of my password expiry. Oops.

So, I logged in this morning to discover I couldn't get on my VPN network. Called lab IT support. Was told to talk call Corporate support, via the 888 number.

No, they couldn't just forward me there. No, there's no IVR automated option for 'Password reset' which auto-forwards my call there.

So, I called the 888 number, and got 4 options, none of which fit my problem. You'd think this would be a FAQ and thus merit a menu option, but apparently not.

Tried the "other resets" option, which tells me to use a website which I can't access because it's behind the VPN firewall. Woo, circles.

Backed up one menu and tried the password reset option for the old AT&T VPN client, which generated an email sent to me (which I can't access as I can't get on the VPN) and to my manager. Manager pinged acting manager, who pinged me on IRC. Thank the gods I managed to convince him to lurk in #eclipse-modeling!

End of story? Hardly. Password didn't work.

Called lab IT support again. Explained problem. Told to call the 888 number again, but this time pick 'Notes password reset' and then speak to a human. Why is 'VPN password reset' hidden under 'Notes password reset' in the IVR menu? Good question.

Called 888 again, chose the Notes option, and was told "for Notes password resets, go see the website ... or, if you tried that and it didn't work (way to instill confidence there), stay on the line and we'll let you talk to a human." (Yes, I'm paraphrasing.) Sat on hold about a minute. Got a human, who reset my password. Woohoo.

Manager pinged acting manager who passed it on to me and this time it worked. Logged into VPN. Story over? No, it gets better.

Fired up Notes. Notes password had expired (Notes has been nagging me for a week to reset my expiring password, but I didn't get any reminders about my VPN password's expiry, and had forgotten that they now expire on the same schedule). So, I can't check mail until reset the password. Used the new one so that they'd be in synch and expire together. All is well?

No, not yet. Checked mail. Found note with new *temporary* password in it, expiring in 24hrs. Damn, gotta pick a new one. Went to password reset website to set new password. Stored new password in password store for safekeeping.

Now I have to reset my Notes password again so that it's the same as the network one. Click File > Security > User Security. Prompted for password. Click Change Password. Prompted for password again. Why do I need to enter my old password three times (at login, to access security options, to change password) to change it? Good question.

An hour of productivity lost, including 4 phone calls and wasting the time of both my managers, just to reset a password. Must be Monday.

Cracking NT passwords

Scenario: Desktop system that's been running linux for about a year, with an oft-ignored WinXP NTFS partition on it for those rare Windows-only tasks.

Problem: So oft-ignored, I've forgotten my XP login password.

Solution: A number of options exist, but I was looking for a simple 'boot into linux partition and then hack such-and-such file'. Didn't find anything like that (and my old'ish linux install doesn't have write-to-NTFS support anyway), so I decided to try a boot CD solution, trusting that if source is provided it's probably not some trojan exploit thingamabob. First one I tried was Peter Nordahl's Offline NT Password & Registry Editor, cd070409.zip, which worked like a charm.

Sidenote: I then updated XP using Windows Update and the machine ground to a halt for a few hours, ultimately having to be shut off because it wouldn't shut down properly. Several reboots later it's working again, but that's pretty much standard for Windows. Gah.