1 #LyX 2.3 created this file. For more info see http://www.lyx.org/
5 \save_transient_properties true
8 \use_default_options false
9 \maintain_unincluded_children false
11 \language_package default
14 \font_roman "default" "default"
15 \font_sans "default" "default"
16 \font_typewriter "default" "default"
17 \font_math "auto" "auto"
18 \font_default_family default
19 \use_non_tex_fonts false
22 \font_sf_scale 100 100
23 \font_tt_scale 100 100
25 \use_dash_ligatures true
27 \default_output_format default
29 \bibtex_command default
30 \index_command default
31 \paperfontsize default
36 \use_package amsmath 0
37 \use_package amssymb 0
40 \use_package mathdots 1
41 \use_package mathtools 1
43 \use_package stackrel 1
44 \use_package stmaryrd 1
45 \use_package undertilde 1
47 \cite_engine_type default
51 \paperorientation portrait
62 \paragraph_separation indent
63 \paragraph_indentation default
65 \math_numbering_side default
70 \paperpagestyle default
71 \tracking_changes false
93 \begin_layout Plain Layout
103 \begin_inset CommandInset toc
104 LatexCommand tableofcontents
111 \begin_layout Section
115 \begin_layout Standard
116 This is a tutorial showing the basic usage of libpwmd
120 \begin_layout Plain Layout
121 https://gitlab.com/bjk/libpwmd/wikis
131 is a library making it easy for applications to use pwmd
135 \begin_layout Plain Layout
136 https://gitlab.com/bjk/pwmd/wikis
143 Password Manager Daemon).
144 Password Manager Daemon
146 is a universal data server.
147 It began as a way to keep track of passwords for accounts like email and
148 websites but has evolved to store anything you want.
149 There are other password management tools but pwmd has a couple of distinguishi
153 \begin_layout Itemize
154 It does not depend on a desktop environment but has the ability for applications
155 to connect to it like a desktop solution provides.
158 \begin_layout Itemize
159 Some portion of a stored data can be shared with another portion in the
161 This feature behaves a lot like a symbolic link on a file system, XML entities,
162 or HTML targets if you're familiar with those, but implemented in a different
164 This means less duplication of content.
166 \begin_inset CommandInset ref
168 reference "sec:Linking-elements"
175 \begin_layout Itemize
176 The XML document is OpenPGP encrypted and signed using an existing or newly
178 Symmetric encryption is also supported as well as smartcards.
179 All crypto operations are done using GpgME which in turn uses gnupg.
182 \begin_layout Standard
183 Other features include:
186 \begin_layout Itemize
188 More than one client may access the same data file while optionally locking
192 \begin_layout Itemize
193 Secure memory management.
194 Pwmd will zero out memory before freeing it and the contents of the cached
195 document are encrypted.
198 \begin_layout Itemize
199 Remote connections over TLS with client certificates used as authentication.
202 \begin_layout Itemize
203 Remote connections over SSH (some configuration needed).
206 \begin_layout Itemize
207 ACL's for each element in an element path, listening socket and filename.
210 \begin_layout Section
211 File Format and Element Paths
214 \begin_layout Standard
215 The document is in XML format and is manipulated by commands sent from a
217 Commands that access previously stored data take what is called an
222 An element path is a character string containing element names representing
223 branches of an element tree.
224 The branches are separated with a TAB (ASCII 0x09) character.
225 Why a TAB? So other characters can be used in the element name.
226 If for example a '/' were used as the separator, then a URL (i.e., http://sf.net/)
227 could not be used as an element name since it would be an XML syntax error.
228 For the rest of this tutorial, when you see <TAB>, replace it with a real
232 \begin_layout Standard
233 For example, the element path "root<TAB>child<TAB>last" has the following
234 element tree structure:
250 Content or XML CDATA of the "last" element.
265 \begin_layout Standard
266 I should say that the XML structure that pwmd uses is a little more complicated.
267 It really looks like the following internally, but we will use the above
268 format in this tutorial for simplicity:
272 <element _name="root">
276 <element _name="child">
280 <element _name="last">
284 Content or CDATA of the "last" element.
299 \begin_layout Standard
300 Every element created has an element named
313 attribute is what an element in an element path refers to.
314 It is done this way so that a wider range of characters can be used in
315 an element name while maintaining valid XML.
316 In fact the only restriction of an element name is that it not contain
317 whitespace characters.
320 \begin_layout Standard
321 There is one other difference from your normal XML document in that only
322 the first match of an element is considered for the current element tree
324 When an element of the current depth of an element tree is found, the next
325 element in the element path is searched for beginning at the child node
326 of the found element.
327 From the example above:
343 Content or XML CDATA of the "last" element.
359 This element will never be reached.
370 \begin_layout Standard
371 The second "<child>" element is never reached because it has the same name
372 as its sibling element
373 \begin_inset Quotes eld
377 \begin_inset Quotes erd
383 \begin_layout Section
387 \begin_layout Standard
392 client to send commands to the pwmd server.
397 includes a client named
402 It is command-line based and there are not any fancy graphics, but it is
403 good for understanding how
407 commands are processed.
408 If you want a more user friendly client that resembles a file manager and
409 has a point and click interface, try QPwmc
413 \begin_layout Plain Layout
414 https://gitlab.com/bjk/qpwmc/wikis
419 which uses the Qt4 or Qt5 toolkit and is also a full featured client.
422 \begin_layout Standard
423 In this tutorial we will use the
427 client included with libpwmd.
432 has two modes that commands are read from: interactive and stdin.
433 The interactive mode uses the readline library and has command history,
434 while reading from standard input (stdin) makes shell scripting and automation
436 For the examples, we will be connecting to the default local unix domain
437 socket (UDS) that pwmd waits for connections on and use interactive mode.
438 Remote connections are also possible over TLS or an SSH channel but those
439 are not covered here.
440 Read the pwmc(1) manual page for details about how to do that.
443 \begin_layout Standard
444 The example filename we will use is "datafile".
445 It is initially a non-existent file but it will be created once we have
447 Now let us connect to the server in interactive mode and open the data
463 \begin_layout Standard
464 The "pwmc>" prompt is a readline prompt that has command history and can
465 also do filename completion when doing a dot command that requires a filename
466 on the local filesystem.
469 \begin_layout Section
473 \begin_layout Standard
474 There are two different types of commands: client commands and protocol
476 The client commands are
480 specific and only available to the
485 Protocol commands are commands sent from any client and to the
490 All pwmc client commands are prefixed with a dot '.' followed by the command
492 Protocol commands are sent without any dot prefix.
493 To see the available pwmc and protocol commands, send the .help or HELP
501 \begin_layout Standard
509 \begin_layout Standard
510 To store some data in an element path or to create an element path, you
511 will need to know what element path to create.
512 It is up to you how you want your data organized.
513 If for example you will be storing account information it may be good to
514 categorize what the account is for: email, instant messaging, blogging,
516 An application that uses libpwmd may require that a certain element path
518 Refer to that applications documentation to determine what element paths
522 \begin_layout Standard
523 In the following example we will setup mail server element paths which can
524 be used for other applications requiring a mail server configuration.
525 First, lets create the hostname element path:
533 Press CTRL-D to send the current line.
538 \begin_layout Standard
539 The STORE command is a
544 This, and a few other commands, use what is called a
548 to retrieve additional command parameters from the client while other commands
549 require only the command itself with its command arguments.
550 The server inquire will wait for the client to finish sending its' data
551 before completing the command.
552 When responding to a server inquire in pwmc, pwmc will show a message informing
553 you that it is waiting for data to be sent.
554 Enter the element path and its content, then press <CTRL-D> twice to finish
555 sending the data and to let
559 complete the command:
563 email<TAB>isp<TAB>IMAP<TAB>hostname<TAB>imap.server.com<CTRL-D><CTRL-D>
566 \begin_layout Standard
567 Remember that you should replace <TAB> in the examples with a real TAB character.
568 After pressing the first <CTRL-D>, the characters that were entered are
573 and the inquire continues.
574 To terminate the inquire and finish sending data for the command press
575 <CTRL-D> a second time.
578 \begin_layout Standard
579 If you were to have pressed <RETURN> before any <CTRL-D> then the inquired
580 line would have been sent in full including a newline character.
581 Since in this example a newline character in a hostname is not a valid
582 hostname, this is not what we want.
585 \begin_layout Standard
586 We have just created an element path whose XML structure looks like the
603 <hostname>imap.server.com</hostname>
618 \begin_layout Standard
619 The GET protocol command returns the value, or content, of the last element
621 To retrieve the hostname of the element path we just created, do:
625 pwmc:datafile> GET email<TAB>isp<TAB>IMAP<TAB>hostname
636 \begin_layout Standard
637 Let us create the rest of the needed elements:
645 email<TAB>isp<TAB>IMAP<TAB>port<TAB>993<CTRL-D><CTRL-D>
657 email<TAB>isp<TAB>IMAP<TAB>ssl<TAB>1<CTRL-D><CTRL-D>
669 email<TAB>isp<TAB>username<TAB>myusername<CTRL-D><CTRL-D>
681 email<TAB>isp<TAB>password<TAB>mypassword<CTRL-D><CTRL-D>
684 \begin_layout Standard
685 Now the element structure for the "email" element looks like this:
701 <hostname>imap.server.com</hostname>
717 <username>myusername</username>
721 <password>mypassword</password>
732 \begin_layout Standard
733 If you wanted to change your password (after changing it on the mail server,
734 of course) just do as you did when initially creating the password element
736 The new content will overwrite the existing content:
744 email<TAB>isp<TAB>password<TAB>newpassword<CTRL-D><CTRL-D>
751 \begin_layout Standard
752 An application using libpwmd that requires mail server information now has
753 the basic information it needs.
754 It may require more elements and they can be created just as these elements
756 The only thing left to do now is to save the changes:
760 pwmc:datafile> <CTRL-D>
763 \begin_layout Standard
764 After pressing <CTRL-D> a prompt will be shown asking what to do next.
766 \begin_inset Quotes eld
770 \begin_inset Quotes erd
773 to save what we have created.
774 This will generate a new encryption and signing key pair by default.
775 If you would rather use an existing encryption and signing key or use symmetric
776 encryption, you will need to use the .save pwmc command along with the required
777 SAVE protocol command options.
778 The .save command lets libpwmd set some things that may be needed for the
779 current connection such as pinentry settings.
784 pwmc:datafile> help save
787 \begin_layout Standard
788 to see SAVE syntax and options.
791 \begin_layout Standard
792 When the save has completed the encrypted data file has been written to
793 disk and is also stored in pwmd's file cache.
794 A cached document is the same document on disc that is stored in memory.
795 This means that the next time the document is opened a passphrase won't
796 be required until pwmd's cache timer removes it from the cache.
797 By default, the cache timeout for each data file is 600 seconds, or 10
799 This setting can be changed in pwmd's configuration and set independently
800 for each file and can also be set to not cache the file at all or to cache
804 \begin_layout Section
805 \begin_inset CommandInset label
807 name "sec:Linking-elements"
814 \begin_layout Standard
815 One distinguishing feature of pwmd is the ability to share data of one element
817 If for example your ISP lets you host a blog on their server and you use
818 a blogging client that can use libpwmd for authentication details, you
819 can share authentication information with the email example above when
820 the account details are the same.
821 When element linking is used, this avoids the need to change the content
822 for both the blogging and email password elements.
825 \begin_layout Standard
826 This is done by setting a special
827 \begin_inset Quotes eld
831 \begin_inset Quotes erd
834 attribute for an element.
835 It behaves similarly to the HTML
836 \begin_inset Quotes eld
840 \begin_inset Quotes erd
843 attribute or XML entities or a symbolic link on a filesystem.
847 \begin_layout Standard
848 Let's create an example blogging element path:
856 blog<TAB>isp<TAB>hostname<TAB>blog.myisp.com<CTRL-D><CTRL-D>
864 pwmc:datafile> ATTR SET _target blog<TAB>isp<TAB>username email<TAB>isp<TAB>user
869 pwmc:datafile> ATTR SET _target blog<TAB>isp<TAB>password email<TAB>isp<TAB>pass
873 \begin_layout Standard
874 Now each access of the "blog/isp/username" and "blog/isp/password" element
875 paths, which were created if they did not already exist, will point to
876 "email/isp/username" and "email/isp/password", respectively.
877 To retrieve the value or content of an element that contains a "_target"
878 attribute, just use the GET command as you would for any other element:
882 pwmc:datafile> GET blog<TAB>isp<TAB>password
893 \begin_layout Standard
894 A "_target" attribute may also refer to another element with a "_target"
896 Every "_target" attribute will be followed until there are no others to
898 To get the real element path and resolve all "_target" attributes, use
899 the REALPATH protocol command:
903 pwmc:datafile> REALPATH blog<TAB>isp<TAB>password
907 email<TAB>isp<TAB>password
914 \begin_layout Standard
915 Using the LIST command is useful to show the element structure of a document:
931 pwmc:datafile> LIST email
943 email<TAB>isp<TAB>username
947 email<TAB>isp<TAB>password
951 email<TAB>isp<TAB>IMAP<TAB>hostname
955 email<TAB>isp<TAB>IMAP<TAB>port
959 email<TAB>isp<TAB>IMAP<TAB>ssl
963 pwmc:datafile> LIST blog
975 blog<TAB>isp<TAB>hostname
979 blog<TAB>isp<TAB>username
983 blog<TAB>isp<TAB>password