Unlock pinenrty on login without password?

pfr

Hey, I'm back with another pointless and crazy idea...

I'm using rbw bitwarden client and I've got a few programs that call rbw get <password> upon launch, like my email and my irc client etc.

I've set up a tmux-session script to load a bunch or windows and panes with specific programs when I login, but obviously, for those programs like email and irc to start properly, the rbw vault needs to be unlocked.

So, I was wondering if it is at all possible to run a script at login, either in my .shrc or .profile which can unlock rbw

My initial thought was to use SSH keys without passwords of their own, but that got confusing and didn;t work. Then I tried using age to encrypt a password inside a file. then at login, decrypt the file and echo it into rbw unlock, but again, no dice.

I'm using pinentry-tty (in the tty) and I feel like it's just not possible to echo a password to pinentry.

Anyone got a clean and relatively secure solution to this. I absolutely do not want to store my bitwarden's master password in a plain text file on my pc.

rvp

pfr So, I was wondering if it is at all possible to run a script at login, either in my .shrc or .profile which can unlock rbw [...]
I'm using pinentry-tty (in the tty) and I feel like it's just not possible to echo a password to pinentry.

Hmm. There is a way, I think, but... the reason rbw uses pinentry for data-input is security. Wouldn't just unlocking the database once at login time, then starting all your programs be just simpler?

pfr

rvp I would be ok with this, but I'd need the pinentry prompt to load up before tmux starts with my custom session etc.

I've set tmux to auto start my custom session immediately after logon.

Here is my ~/.ashrc. As you can see, I'v tried using an unlock script already but it didn't work so I commented it out.


# Make prompts cool again
user_color=$'\e[94;1m'
prompt_char=%
if [[ $(id -u) -eq 0 ]] ; then
    user_color=$'\e[31;1m'
    prompt_char='#'
fi
PS1='\[$user_color\][\u]\[\e[0m\] \[\e[90;1m\]\w\[\e[0m\] \[$user_color\]$prompt_char\[\e[0m\] '

# Aliases
if [ -f ~/.ash_aliases ]; then
    . ~/.ash_aliases
fi

# Zoxide (fancy 'cd')
eval "$(zoxide init posix --hook prompt)"

# unlock rbw before starting session
#sh $HOME/.rbw_password.sh

# Launch tmux automatically
if command -v tmux>/dev/null 2>&1; then
    # Check if tmux is already running
    if [ -z "$TMUX" ]; then
        # Not inside tmux, proceed to check if the session exists
        if ! tmux has-session -t mysession 2>/dev/null; then
            $HOME/.tmux-session.sh
        else
            tmux attach-session -t mysession
        fi
    fi
fi

I wouldn't want to simply put the rbw unlock command in my shell rc as it'd get executed every time I open a new tmux pane... unless I do the same as the tmux command, and check if the database is unlocked first?

Even still, would this trigger pinentry before opening tmux?

My email client will trigger the pinentry, which is fine, but my irc client will look for the password, but if the database isn't unlocked, it'll just start unauthenticated.

kc9udx

~/.profile only runs on login, where ~/.*shrc runs on every new shell.

rvp

kc9udx ~/.profile only runs on login, where ~/.*shrc runs on every new shell.

Correct; but, the user can login on multiple terminals (or run something like xterm -ls or sh -l on some shells) and then we're back to square one 🙁... so,

I think we can get this working in multiple ways w/o compromising security:

The easiest would be to do something like this in .profile (if I've read the docs. right):
```
rbw unlocked || rbw unlock
```
That should unlock the DB only once. (In fact, according to the docs., rbw unlock alone might work because, "Commands can generally be used directly, and will handle logging in or unlocking as necessary."; so multiple unlocks shouldn't prompt for passwords more'n once...)

If 1) isn't satisfactory, you could do what I do here: count the no. of logged-in instances. For ash, something like this in ~/.profile (or elsewhere) should do it:

# source this file from ~/.profile

isloginsh() {
	case $0 in
	-*)	return 0 ;;
	*)	return 1 ;;
	esac
}

# Things to note about this function:
#
# 1. `exec awk ...' is used replace the shell because, in some shells, a new
#    (login) shell may be spawned by $(), thus messing up the process counts.
#
# 2. Use `cmd | getline' in awk instead of `busybox ps ... | awk' for the
#    same reason: new login shells may be spawned to execute pipeline cmds.
#
# 3. Due to 1), the only way to use nlogins() is in constructs like $()
#    where a new shell is spawned and then can be replaced. In any other usage,
#    the shell will terminate after awk is finished because of the `exec'.
#
nlogins() {
	exec awk -v U=$(id -nu) -v S=$0 '
BEGIN {
	cmd = "busybox ps -o user,args"
	while ((cmd | getline) > 0)
		if ($1 == U && $2 == S)
			n++
	close(cmd)
	print n + 0
}
'
}

my_initonce() {
	isloginsh || return 0
	[ $(nlogins) -eq 1 ] || return 0

	echo Init...
}

my_finionce() {
	isloginsh || return 0
	[ $(nlogins) -eq 1 ] || return 0

	echo Fini...
}

trap my_finionce EXIT
my_initonce

pfr

I've moved the tmux stuff over to ~/.profile and have added rbw unlock. Send to work.

I get one prompt at login and that's it.

Cheers

kc9udx

There's still the odd chance that you login a second time. Especially if you need to login from a different virtual terminal to fix something, you wouldn't want all that stuff happening again.

If it were me, I'd create a semaphore. I'd check for the existence of a file in /tmp or maybe in ~/. If it doesn't exist, touch the file and then run your startup. Delete the file from within /etc/rc.local (and probably if you quit tmux, or something.

pfr

Ok, so no longer in my ~/.ashrc but instead in my~/.profile

# ~/.profile
#
# Set your PATH and ENV variables here.

export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$HOME/.cargo/bin"

if [ -z "$XDG_RUNTIME_DIR" ]; then
        XDG_RUNTIME_DIR="/tmp/$(id -u)-runtime-dir"

        mkdir -pm 0700 "$XDG_RUNTIME_DIR"
        export XDG_RUNTIME_DIR
fi

export EDITOR=vim
export PAGER='bat -p'
export SHFM_OPENER=$HOME/.open.sh
export FZF_DEFAULT_OPTS='--height 100% --no-separator --layout=reverse --ansi --preview-window=75%'

# Commands to run only once at login
if [ -z "$LOGIN_RUN" ]; then
    export LOGIN_RUN=1
    brightnessctl -q set 5
    amixer -q set Master 7 unmute
    setfont /usr/share/consolefonts/ter-114b.psf.gz
    rbw unlock
fi

# Launch tmux at login
if command -v tmux>/dev/null 2>&1; then
    # Check if tmux is running
    if [ -z "$TMUX" ]; then
        # Check if a session exists
        if ! tmux has-session -t mysession 2>/dev/null; then
            # Run setup script
	    $HOME/.tmux-session.sh
        else
            tmux attach-session -t mysession
        fi
    fi
fi

ENV=$HOME/.ashrc; export ENV
. $ENV

For some reason tmux opens new panes as login shells, not matter what I do. Do this was the only way I could figure out to not have those few commands run everytime I split a pane.

If anyone has a neater solution please let me know

kc9udx

pfr wrap your commands to run only once at login in

if ! [ -e ~/.logged-in ]; then
touch ~/.logged-in
#... Put it here ...
fi

And put this in /etc/rc.local
rm -f /home/user/.logged-in

You could do this in .shrc but keep it in .profile just for cleanliness.

Beware that I'm not near a terminal at the moment and might have given you some syntax errors.

pfr

kc9udx
That's probably a better solution, because it tmux is opening new panes with login shells then what I have make's no difference, they'll be run again.

Cheers for this.

I'm still curious why tmux insists on opening login shells though. Even after setting:

set -g default-shell /bin/ash
set -g default-command /bin/ash

inside my ~/.tmux.conf. I even tried set -g default-command "/bin/ash -i" without success.

EDIT:
I should also just clarify that I'm using Alpine Linux, not BSD (hence no specific BSD tag). So I did some more research, and well, I've been going about this all wrong (not surprised). Apologies for not specifying the OS prior, and given we're on a BSD forum, I've probably made a faux pass.

Anyway...

Alpine uses OpenRC and /etc/local.d/ for startup services. So I'll just add the commands to /etc/local.d/startup.once and enable it with rc-update add local default

I just thought, there would be a simple, OS agnostic way to do this.

EDIT 2:
This is just for me now..

Because the rbw unlock command requires an interactive shell for pinentry to activate, that command in particular wont work if executed at boot, before login. SO maybe I'll stick with your method above with something like this

echo 'rm -f /home/$USER/.logged-in' | doas tee /etc/local.d/reset-login.once
doas chmod +x /etc/local.d/reset-login.once
doas rc-update add local default

And just keep the commands wrapped inside ~/.profile like so.

if ! [ -e ~/.logged-in ]; then
    touch ~/.logged-in
    brightnessctl -q set 5
    amixer -q set Master 7 unmute
    setfont /usr/share/consolefonts/ter-114b.psf.gz
    rbw unlock
fi

EDIT 3:
Actually, I've moved all other commands to /etc/local.d to be run with OpenRC at boot and just left the rbw unlock command inside ~/.profile. I feel like this it the most sensible.

I'd still prefer a solution that prevents tmux from opening login shells. That's a mystery that will bug me until I figure it out.

kc9udx

pfr

I'd still prefer a solution that prevents tmux from opening login shells. That's a mystery that will bug me until I figure it out.

Apparently it does this by design. I think it's a bad way to do things but possibly screen does it, so users expect tmux to do it too?

Putting the following in your tmux.conf should avert this:
set -g default-command "${SHELL}"

rvp

pfr I should also just clarify that I'm using Alpine Linux, not BSD

That uses musl and not glibc so who won't work. I've update the functions above...

pfr

kc9udx Putting the following in your tmux.conf should avert this:
set -g default-command "${SHELL}"

I tried this also, doesn't seem to work.

rvp I dont see the need for anything fancy. What I already had does seem to work. I've placed all the other commands (volume, brightness, font) into a system service instead.

if [ -z "$LOGIN_RUN" ]; then
    export LOGIN_RUN=1
    rbw unlock
fi

rvp

pfr I dont see the need for anything fancy. What I already had does seem to work.

There're at least 2 issues with your method:

It only works for one terminal. If you login on any other terminal (ssh, xterms, ...), rbw unlock will be run again (which might be a no-op--I don't use rbw so I don't know if this is the case...).
What does a rbw lock? Again, I don't know what the implications of not issuing a rbw lock are.

The file-creation method (incidentally, if you want to do this, create a file in /run/$UID/... which is secure and is on tmpfs, so no need to clean anything at boot-time) doesn't suffer from #1, but, is subject to #2:

If rbw unlock is done once, it stays that way even if the guard file is deleted. Something has to do rbw lock, I think--unless it the agent autolocks things after a hour, or a reboot sets everything back defaults...

pfr

I'd get fancy if I could do it without a password like originally intended.

But, I realise that's not very secure 😅