yapet — store passwords encrypted on disk
yapet
[[-c
] | [-h
] | [-V
]] [[-s
] | [-S
]] [-t
{sec
}] [filename
]
yapet stands for "Yet Another Password Encryption Tool" and is a curses(3X) based program for storing passwords encrypted on disk. It relies on the crypto(3) library provided by OpenSSL for encrypting and decrypting the passwords. The cipher for encryption and decryption is Blowfish with a 448 bits key.
Invoking yapet without any command line arguments given, a screen as shown in "Figure 1, “Main screen”" will be displayed.
Figure 1. Main screen
..::|| YAPET 0.4 ||::.. +---------------------------++---------------------------+ | || K E Y S | | ||---------------------------| | || S Save File | | || R Load File | | || L Lock Screen | | || A Add Entry | | || D Delete Entry | | || O Sort Order | | || / Search | | || N Search Next | | || C Change Password | | || ^L Redraw Screen | | || Q Quit | | || | | |+---------------------------+ | |+---------------------------+ | || | | || | | || | | || | +---------------------------++---------------------------+ No file loaded
The upper right frame in "Figure 1, “Main screen”" shows the keys recognized by yapet. The keys are not case-sensitive. Following a short explanation of the keys:
Load (read) a file from disk. This command is also used to create a new file. When creating a new file, enter the file name into the entry field. yapet will ask whether it should create the file if it does not exist.
Lock and blank the screen. Has only effect if a file is loaded. In order to unlock the screen, the password of the currently loaded file has to be entered.
Add a new password entry to the currently loaded file. The entry will be permanently added to the file when the file is saved by pressing S.
Before this function can be used an existing file has to be loaded, or a new file has to be created by pressing R.
Delete a password entry from the currently loaded file. The entry will be permanently deleted if the file is saved by pressing S.
Change the sort order to either ascending or descending. This setting is not kept permanently and is lost upon restart of yapet.
The default sort order is ascending.
Start a new search. yapet can search the name of the entries for a particular term. If the term is found, the item is highlighted. The search can be repeated by pressing N.
Repeat the search using the search term specified by invoking the search functionality by pressing /.
Change the master password of the currently loaded file. This
action requires to save all changes first. The file with the old
master password will be saved as
where
filename
.pet.bakfilename
is the name of the currently
loaded file.
Redraws the screen.
Quit yapet. If changes were not saved yapet will ask whether they should be saved or not. Regardless of the answer, yapet quits, either saving the changes or discarding them.
The empty frame on the left side of the main screen will display the password entries' Name. The selection can be moved by using Up, Down, Page Up, Page Down, Home, and End keys. An entry can be opened for viewing and editing by pressing Enter.
Passwords are stored as records (also referred to as entries) having the fields as shown in "Figure 2, “Password record dialog”" below.
Figure 2. Password record dialog
+-P A S S W O R D R E C O R D--------------------+ |Name | |_________________________________________________| |Host | |_________________________________________________| |Username | |_________________________________________________| |Password | |_________________________________________________| |Comment | |_________________________________________________| | | |[ OK ] [ Cancel ] | +-------------------------------------------------+
The fields have the following meaning:
Files created by yapet always have the suffix
.pet
. This cannot be changed by the user. Also, if a
file is loaded using the command line the suffix .pet
is appended to the file name given that it was not specified by the
user.
The password entries are protected by a master password. The master password is used to encrypt and decrypt the records. If the master password is lost, so are the records.
The Tab key will switch the focus to the next widget. Be aware that Shift+Tab does not work for focusing the previous widget.
By pressing the Esc key dialogs will be canceled and closed.
If there is no key pressed for more than ten minutes (by default) or
the amount of time specified using the -t
option, yapet
will blank and lock the screen. It will prompt for the password of the
currently load file when a key is pressed. This is the same behavior as
seen by pressing the key L.
The following options are supported:
-c
, --copyright
Show the copyright information.
-h
, --help
Print a help text.
-s
, --no-file-security
Disable the check for the owner and file mode when loading files. Without this option, yapet checks password files for having the same owner as the user running yapet and verifies that the file mode is strictly 0600. If one of these conditions are not met, yapet refuses to load the file. Providing this options disables those checks and yapet will load files with owners other than the process owner of yapet and file modes different from 0600.
New files saved while this option is active will have the file mode set to 0644.
-S
, --file-security
Enable the check for the owner and file mode when loading files. This option makes yapet to load password files having the owner set to the process owner of yapet and the file mode strictly set to 0600 only. If one of these conditions are not met, yapet refuses to load the file.
New files saved while this option is active will have the file mode set to 0600.
This is the default mode.
-t
sec
,
--timeout
sec
Set the timeout until the screen is locked to
sec
seconds. The minimum time allowed is
10 seconds. If a lower value is provided, the timeout will be set to
10 seconds.
-V
, --version
Show the version of yapet.
filename
The file to open upon invocation of yapet. If the file does not exist, yapet asks whether it should be created.
Files created by yapet always have the suffix .pet
.
If the file ~/.yapet
exists, yapet reads the
options provided in this file. Options given on the command line have
precedence over options given in the configuration file.
The configuration file has the following syntax:
option
=value
where option
can be any of the following:
load
The file to load upon start of yapet.
locktimeout
A positive integer specifying the time of inactivity in seconds until the screen is locked.
checkfsecurity
A value of 1 (one) or 0 (zero). A value of 1 enables the verification of the file owner and permissions when loading a file. A value of 0 disables the verification of the file owner and permissions when loading a file.
See the section called “EXAMPLES” for examples of configuration files.
Options are case-sensitive. Spaces are not allowed before or after the equal sign. Syntax errors and unrecognized options are ignored silently.
Although several precautions were taken to avoid having any passwords stored clear text in memory, there were occassions when core files contained the master password. This means that it is possible, though not likely, for a malicious user to get hold of one or more passwords while YAPET is running.
$HOME
/.yapet
The per-user configuration file. If existing, options are read from this file but can be overridden by the command line options.
Example 1. Example of an yapet configuration file.
load=/home/joe/passwords
locktimeout=300
checkfsecurity=0
In this example, the file /home/joe/passwords
will be loaded upon invocation of yapet. The timeout until the screen is
locked set to 300 seconds. File permissions will not be verified.
Example 2. Example of an yapet configuration file.
locktimeout=150
checkfsecurity=1
In this example, no file will be automatically loaded upon invocation of yapet. The timeout until the screen is locked set to 150 seconds. File permissions and owner will be verified.
The user interface is clumsy and not really user friendly. It may flicker while running yapet in a secure shell session.
Clearing the memory when it is no longer used seems buggy since the master password is written to a core file sometimes.
Please report other bugs to the author (see the section called “AUTHOR”).
YAPET -- Yet Another Password Encryption Tool
Copyright (C) 2008, 2009 Rafael Ostertag <rafi@guengel.ch>
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/.
Additional permission under GNU GPL version 3 section 7. If you modify this program, or any covered work, by linking or combining it with the OpenSSL project's OpenSSL library (or a modified version of that library), containing parts covered by the terms of the OpenSSL or SSLeay licenses, Rafael Ostertag grants you additional permission to convey the resulting work. Corresponding Source for a non-source form of such a combination shall include the source code for the parts of OpenSSL used as well as that of the covered work.