1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
|
Using revision control with CPM
=======================
Since the CPM password database is encrypted, we can safely check it into a revision control system to receive the following benefits:
* audit trail (who changed the password database)
* backups (passwords are stored centrally and on user nodes)
* easy rollbacks
* lock notification for multiple users
Note however that since the database is encrypted we _cannot_ see which passwords have been added/modified/deleted unless we decrypt the database.
When using a cpm wrapper script to access the database, the checkout/diff/checkin can be automated to the point where all you're interacting with is CPM.
Here is how to use CPM with GIT on ubuntu and debian:
[[First, set up CPM as per usual|Home]]. Then, follow this scripted guide:
Create decentralized CPM
----------------------------
::
## Create a git repo
# create a git user
root@server# groupadd -g 617 git && useradd -g 617 -u 617 git
root@server# su git
# add users keys to git's authorized keys
git@server$ mkdir -p .ssh && chmod 700 .ssh cat me.pub you.pub him.pub >> .ssh/authorized_keys
# create a bare git repo on the _server_
git@server$ git init --bare --shared cpmdb.git
## setup your CPM database in GIT
# fetch the empty repo from a user machine
me@mine$ git clone git@server:cpmdb.git
# import your cpmdb and cpmrc
me@mine$ mv ~/.cpmdb ~/.cpmrc cpmdb/
# import the cpmgit wrapper
me@mine$ cat > cpmgit << EOF
#!/bin/sh
cd ~/cpmdb
git pull
/usr/bin/cpm -f cpmdb -c cpmrc
if [ -z "`git diff --name-only`" ]
then
echo "No change"
else
RNDMSG="$(dd if=/dev/urandom bs=100 count=1 | tr -cd '[:alnum:]' | head -c 8)"
git commit -am "$RNDMSG"
git push
fi
EOF
me@mine$ chmod +x cpmgit
#Run the script, create a cpm database and add your group members keys.
me@mine$ ./cpmgit
# Commit and push the changes
me@mine$ git add cpmrc cpmdb cpmgit && git commit -m 'initial'
# install the cpmgit script
me@mine$ mkdir -p ~/bin & ln -s ~/cpmdb/cpmgit ~/bin
## Use the 'cpmgit' script every day
me@mine$ cpmgit
## Wash, rinse, repeat
Deploy existing decentralized CPM
---------------------------------
If someone already has a CPM database in git they want to share with you,
simply clone the git repo, install the script and use gpg-agent or gnome-keyring to avoid punching passwords too often. You can even use GPG-smartcards if you wish.
Some caveats
-------------
* all users on the central server should be members of the same group
* the central git repo should be shared to avoid permission problems
* all users must have all other users in their gpg public key ring, *and they must trust these keys*, otherwise CPM will refuse to operate on the database
::
gpg --recv-keys ADHDAFG ASDAFAFH # import group members' keys
gpg --update-trustdb # give marginal trust to above keys
Using multiple CPM databases
===================
You might be sharing different passwords with different groups of people, and this technique makes group sharing easy: simply make a different git repo for each group, encrypt with different keys and make multiple scripts, each of which opens a different database. For instance, you can have *cakecpm* and *muffincpm* for sharing the cake and muffin secret recepies, respectively.
Upon the eventual conflict
===================
If / when you get a commit conflict (git rejects your push) this means you added some passwords while someone else added some passwords, and the other guy beat you to the push.
You haven't lost the passwords you added - they are still in ~/cpmdb/cpmdb. To get back to normal you should reset, pull their changes and then add your own changes. Here's how to do that:
::
## open up cpmdb first and find your passwords just incase you forgot which password add/change caused the conflict
me@mine$ cpm -f ~/cpmdb/cpmdb
## reset the repo, deleting your changess
me@mine$ git reset --hard
## run cpmgit as normal
me@mine$ cpmgit
## add your passwords and push quickly now to avoid having the same problem!
|
