authinfo-utils is a user-space password cache and retrieval suite
for Emacs- or netrc-style ~/.authinfo.gpg files. It exposes a local
Unix-domain socket through which other programs can request a password
for a specific (machine, login, port) triple.
Unlike plain GPG pass-throughs, every request is gated by a pluggable authentication module chain. This means you can require an X11 click-through, a TTY reply, or a custom script before the daemon hands over the password.
- aid (8)
- The user daemon. Decrypts, caches, and serves lookups.
- aictl (1)
- The command-line client. Prints the password to stdout.
- aixapprove.so (8)
- Pops a bare-Xlib window asking the user to approve or deny a request.
- aitapprove.so (8)
- Broadcasts a message to a user’s TTYs and waits up to 60 seconds for a y/n reply via a FIFO.
- aiexec.so (8)
- Runs an external shell command. Approves if exit status is 0.
- aisuccess.so (8)
- Always approves.
- aideny.so (8)
- Always denies.
autoconf, automake, libtool, pkg-config, libx11-dev, gpg
./autogen.sh
./configure
make
sudo make installThis will install:
/usr/local/bin/aid/usr/local/bin/aictl- Pluggable authentication modules in
/usr/local/libexec/authinfo-utils/ - Manual pages in
/usr/local/share/man/
Create a standard Emacs- or netrc-style authinfo file, encrypted with your GPG key.
cat > ~/.authinfo <<EOF
machine imap.example.com login alice port 993 password sekret
machine smtp.example.com login alice port 587 password p@ssw0rd
EOF
gpg -e -r mail@example.com ~/.authinfo
rm ~/.authinfoCreate ~/.authinfo.aiconf to define your approval chain. Modules are
evaluated in order. For example, using X11:
cat > ~/.authinfo.aiconf <<EOF
# Require an interactive X11 confirmation
required aixapprove.so
EOFIf this file is missing or empty, all requests are denied.
You can run aid from your X profile, .bashrc, or a systemd user unit.
For example, a systemd user unit (~/.config/systemd/user/aid.service) could be:
[Unit] Description=authinfo password daemon [Service] ExecStart=/usr/local/bin/aid Restart=on-failure [Install] WantedBy=default.target
Start this unit with:
systemctl --user daemon-reload
systemctl --user enable --now aidUse aictl from your scripts.
- In an interactive shell
-
aictl imap.example.com alice 993 - In
msmtp -
passwordeval aictl smtp.example.com alice 587 - In
mbsync(isync) -
PassCmd "aictl imap.example.com alice 993" - In a shell script
-
pass=$(aictl backup.example.com root)
When aictl is invoked, aid triggers the modules in
~/.authinfo.aiconf. If approved, the password is printed to stdout.
Authinfo-utils suite is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
Authinfo-utils suite is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see https://www.gnu.org/licenses/.
Authinfo-utils suite is not part of GNU Emacs.
Authinfo-utils suite may use and invoke cryptographic programs and/or cryptographic libraries.
A number of nations restrict the use or export of cryptography. If you are potentially subject to such restrictions, you should seek legal advice before attempting to develop or distribute cryptographic code.
Report vulnerabilities to Qiyang Sun <Q.Sun@soton.ac.uk>, OpenPGP
fingerprint CB62 5507 1605 BE64 EB0F 7B14 642B E6F2 78BD 9E92.
Report bugs to Qiyang Sun <Q.Sun@soton.ac.uk>.
Consult the man pages for detailed usage: man 8 aid, man 1 aictl,
man 5 aiconf, man 3 aipam, man 8 aiexec, man 8 aideny, man 8
aisuccess, man 8 aitapprove, man 8 aixapprove.