Pass - Arch Linux 中文维基

跳至內容

# Pass

出自 Arch Linux 中文维基

本文或本節內容已經過時。

原因： 請提供模板的第一個位置參數以概括原因。 (在Talk:Pass討論)

本文或本節需要翻譯。要貢獻翻譯，請訪問簡體中文翻譯團隊。

附註： Partial translation, abandoned since creation 2020-05-14.（在 Talk:Pass# 中討論）
翻譯狀態：

- 本文（或部分內容）譯自 Pass，最近一次同步於 2020-05-14，若英文版本有所更改，則您可以幫助同步與翻譯更改的內容。
- 您可以在 ArchWiki 的對應頁面找到本文翻譯的原始修訂歷史。
- 本文可能與英文原文存在出入。

官網提到:

  密碼管理應該要簡易且遵照Unix哲學。Pass將你的密碼保存在由gpg加密的文件中，並以相關的網站和資源的名稱來命名文件。這些加密文件會被組織成合理的文件體系，你可以從一台裝置複製到另一台裝置，並用命令行程序來管理和操作它們。

Pass是一款簡易的命令行密碼管理器，本質上，它其實是利用GnuPG、tree包、和Git的腳本。

## 安裝

安裝 pass包 軟體包.

另外還有圖形Qt界面軟體包可供安裝：qtpass包

## 基本用法

注意：在使用Pass前，請先配置好GnuPG。Pass所使用的密鑰信任程度(trust level)必須為"ultimate"。

初始化：

    $ pass init <gpg-id or email>

若要創建一組新密碼，提供一個文件名，注意文件名需要能體現出文件層次，如：archlinux.org/wiki/username。

    $ pass insert archlinux.org/wiki/username

以文件組織的方式查看儲存的密碼：

    $ pass

    Password Store
    └── archlinux.org
        └── wiki
            └── username

生成一組隨機的新密碼，執行如下命令，其中，正整數`n`代表想要的密碼長度。

    $ pass generate archlinux.org/wiki/username n

若要取得一組密碼，執行如下命令，並在彈出窗口輸入你的gpg密碼短語(passphrase)，如使用以上範例：

    $ pass archlinux.org/wiki/username

若您是Xorg用戶並安裝了xclip包，您可以直接將取得的密碼暫時的複製到剪貼板(clipboard)上；若您是Wayland用戶，pass-gitAUR 則會使用 wl-clipboard包，如使用以上範例：

    $ pass -c archlinux.org/wiki/username

注意：如果您喜歡以點擊滑鼠滾輪的方式來貼上密碼，您可以在自己的 `~/.shellrc` 中添加：`export PASSWORD_STORE_X_SELECTION=primary`

pass 也有附加的功能可與dmenu包相結合，讓用戶可以輕鬆的搜索和複製粘貼。若要使用它，安裝如下可選依賴dmenu包後，執行：

    $ passmenu

當您選擇一組密碼時，dmenu將會複製密碼到剪貼版上。dmenu(1) 有更多相關的自定義選項。為了更快的取得密碼，您可以把這個命令綁定在一組系統快捷鍵上。

## 信息格式

由`pass insert`新建的信息文件預設只會包含您的密碼，有時這仍舊不太足夠，因為一些應用可能會要求取得您的其他信息如：用戶名、網站地址等。這時，您可以用以下命令，編輯一個已存在的信息文件：

    $ pass edit password_name

如下是由官網推薦的信息排版格式。使用這種格式時，選項`-c`或`--clip`僅會複製第一行的密碼。

    YwrZSNH35z164ym9pI
    URL: *.amazon.com/*
    Username: AmazonianChicken@example.com
    Secret Question 1: What is your childhood best friend's most bizarre superhero fantasy? Oh god, Amazon, it's too awful to say...
    Phone Support PIN #: 84719

## 遷移到pass

在這裡可以找到相當多腳本可將其他應用的密碼導入pass。

## 擴充

自版本1.7起，pass開始支援由社區開發的擴充，這些擴充包含一些新的命令，用以延伸pass的功能。

- pass-tomb (pass-tombAUR)

可將信息文件以tomb加密

- pass-otp (pass-otp包)

一次性密碼(OTP)支援

- pass-import (pass-importAUR)

從其他管理器導入密碼的綜合工具

- pass-update (pass-updateAUR)

一種更新密碼的快捷方式

- pass-audit (pass-auditAUR)

一款用以審查密碼安全性的擴充

## 進階用法

可使用環境變量修改pass設定中執行存取和git命令的地方：

    PASSWORD_STORE_DIR=/path/to/store

若想進一步了解怎麼修改變量使pass支持存取多個密碼倉庫，參閱此處

以下的`pw()`別名範例將信息文件中第一行複製到剪貼板上，五秒後再複製第二行，再五秒後複製一組一次性密碼(OTP)。如果信息文件中的第一行為密碼(password)，第二行為用戶名(username)，並包含一組一次性密碼(OTP)URI，此範例可按照username > password > otp code的順序將三者貼入空白欄位中(如瀏覽器的登入註冊表)。

    pw() {
    export PASSWORD_STORE_CLIP_TIME=8
    export PASSWORD_STORE_X_SELECTION=primary
    pass -c2 $1; sleep 5; pass -c $1; sleep 5; pass otp -c $1; exit
    }

## Multiple pass Contexts (e.g. Teaming)

One can use aliases to set up different pass contexts, which helps when collaborating with different teams. We have gotten this working in bash as follows:

Add aliases to your `~/.bashrc`:

     alias passred="PASSWORD_STORE_DIR=~/.pass/red pass"
     alias passblue="PASSWORD_STORE_DIR=~/.pass/blue pass"

Add these for bash-completion to your `~/.bash_completion` and make sure bash-completion包 is installed:

     source /usr/share/bash-completion/completions/pass
     _passred(){
         PASSWORD_STORE_DIR=~/.pass/red/ _pass
     }
     complete -o filenames -o nospace -F _passred passred
     _passblue(){
         PASSWORD_STORE_DIR=~/.pass/blue/ _pass
     }
     complete -o filenames -o nospace -F _passblue passblue

Now you can initialize into `~/.pass/red` and `~/.pass/blue` and have two pass contexts with the `passred` and `passblue` aliases. You can generalize this further into as many contexts as you like.

## Git integration

### Git helper usage

You can use `pass` as a credentials helper for `git`. Install the pass-git-helperAUR or pass-git-helper-gitAUR package. Detail are described in the github README file.

#### `git` Configuration

Install `pass-git-helper` as a git credentials helper by calling:

    git config --global credential.helper /usr/bin/pass-git-helper

#### Mapping File

Create the file `~/.config/pass-git-helper/git-pass-mapping.ini`. It is used to map git remote hosts to your `pass` database. The format is something like this:

    [github.com]
    target=dev/github

    [*.fooo-bar.*]
    target=dev/fooo-bar

You can use wildcards in the host part, as shown in the example.

#### Password Store Layout

As usual with pass, the helper assumes that the password is contained in the first line of the passwordstore entry. Additionally, if a second line is present, this line is interpreted as the username.

For this to work, you have to use `pass insert --multiline` to create a multi line password store entry.

### Central Git server for pass in combination with GnuPG (SSH example)

You are able to setup a password management system by setting up a central Git server for Pass. This allows you to synchronize your central password repository through multiple client environments.

#### Install a bare Git repository for Pass on the server

On the server run `git init --bare ~/.password-store` to create a bare repository you can push to.

#### Import authorized public SSH keys

See SSH keys#Copying the public key to the remote server

#### On the client

This section assumes you have configured GnuPG and have a key pair to encrypt passwords. On your local client ensure you have a local password store on the client, then enable management of local changes through Git, add your remote Git repository, and push your local Pass history.

    # Create local password store
    pass init <gpg key id>
    # Enable management of local changes through Git
    pass git init
    # Add the the remote git repository as 'origin'
    pass git remote add origin user@server:~/.password-store
    # Push your local Pass history
    pass git push -u --all

Now you can use the standard Git commands, prefixed by `pass`. For example: `pass git push`, or `pass git pull`. Pass will automatically create commits when you use it to modify your password store.

## Troubleshooting

### Encryption failed: Unusable public key

The following error can occur when attempting to insert a new entry:

    $ pass insert archlinux.org/wiki/username
    Enter password for archlinux.org/wiki/username:
    Retype password for archlinux.org/wiki/username:
    gpg: XXXXXXXXX: There is no assurance this key belongs to the named user
    gpg: [stdin]: encryption failed: Unusable public key
    Password encryption aborted.

This occurs if the trust level of the GnuPG key is set to anything other than "ultimate." Edit the key used for `pass` to set its trust level to "ultimate."

## See also

- A more comprehensive pass tutorial
- Pass home page
- List of Compatible clients and possibilities for migration to Pass

分類：​

- 使用「模板:過時」標記的頁面或章節
- 密碼管理器
- 終端應用程式

隱藏分類：​

- 使用「模板:Translateme」標記的頁面或章節

Pass
新增話題