Keepassxc: Provide password cache for keepassxc-cli

[azzamsa]

Expected Behavior

keepassxc-cli should have password cache, that similar to github password cache in git

Current Behavior

keepassxc-cli always prompt user a password in every operation

Possible Solution

implement it :)

Debug Info

KeePassXC - Version 2.2.4
Revision: 4723f66

Libraries:

• Qt 5.7.1
• libgcrypt 1.7.6-beta

Operating system: Debian GNU/Linux 9 (stretch)
CPU architecture: x86_64
Kernel: linux 4.9.0-4-amd64

Enabled extensions:

• KeePassHTTP
• Auto-Type
• YubiKey

[laur89]

Agreed; could keepassxc-cli communicate with client, if running, to ask for authentication status.

Additionally it'd be great if it defaults to whatever database currently loaded in keepassxc client, eg we could do

keepassxc-cli locate mysearch

instead of current

keepassxc-cli locate /path/to/my_db.kdbx mysearch

[TheZ3ro]

with this the cli interface will depend on the gui client, right now the cli interface is pure cli that works standalone (can work without the gui installed)

[droidmonkey]

This is where the keyring integration would be nice

[wohali]

Except that keyring integration is not available on all platforms, and not necessarily desired (especially on Windows).

Yes, I'd love to see the CLI client (or an alternative CLI client) have a mode that is similar to the browser plugin, where you auth it every X minutes and it can query for passwords on demand.

[sjamesr]

Maybe you can use the open command now, this will give you an interactive session where you can issue multiple commands on the same database without giving a password each time.

[wohali]

@sjamesr Hrm, I'd have to use an expect script to automate this, and I'd have to have a background process running all the time with the open command running in it, _and_ have some sort of RPC mechanism. Sounds bad.

Let me explain my use case: the idea is to provide scripting for my employees. They have a keepassxc database with some corporate passwords in them to access machines. I want them to be able to ssh to various machines in our infrastructure without being prompted. This could be for provisioning, or port forwarding, or other needs. A 3 or 4 line shell script should be all this needs, but right now I can't do this with keepassxc-cli at all.

[droidmonkey]

Please expand your description of your use case because I don't understand how you can have no prompt at all for your workers. At some point someone needs to unlock the database. Where/when does that occur in your use case?

[wohali]

@droidmonkey If keepassxc is unlocked on their laptop already, then the CLI should be able to connect to that and retrieve the credentials. If it's not unlocked, it would prompt for a password.

[droidmonkey]

Gotcha perfect. I think we can abuse the browser proxy for this purpose.

[raphaelahrens]

Hi,
there is a tool which seems to do what you describe here, at least for git.
git-credential-keepassxc