1 #LyX 2.2 created this file. For more info see http://www.lyx.org/
5 \save_transient_properties true
8 \use_default_options false
9 \maintain_unincluded_children false
11 \language_package default
14 \font_roman "default" "default"
15 \font_sans "default" "default"
16 \font_typewriter "default" "default"
17 \font_math "auto" "auto"
18 \font_default_family default
19 \use_non_tex_fonts false
22 \font_sf_scale 100 100
23 \font_tt_scale 100 100
25 \default_output_format default
27 \bibtex_command default
28 \index_command default
29 \paperfontsize default
34 \use_package amsmath 0
35 \use_package amssymb 0
38 \use_package mathdots 1
39 \use_package mathtools 1
41 \use_package stackrel 1
42 \use_package stmaryrd 1
43 \use_package undertilde 1
45 \cite_engine_type default
49 \paperorientation portrait
59 \paragraph_separation indent
60 \paragraph_indentation default
61 \quotes_language english
64 \paperpagestyle default
65 \tracking_changes false
87 \begin_layout Plain Layout
97 \begin_inset CommandInset toc
98 LatexCommand tableofcontents
105 \begin_layout Section
109 \begin_layout Standard
110 This is a tutorial showing the basic usage of libpwmd
114 \begin_layout Plain Layout
115 http://libpwmd.sourceforge.net/
125 is a library making it easy for applications to use pwmd
129 \begin_layout Plain Layout
130 http://pwmd.sourceforge.net/
137 Password Manager Daemon).
138 Password Manager Daemon
140 is a universal data server.
141 It began as a way to keep track of passwords for accounts like email and
142 websites but has evolved to store anything you want.
143 There are other password management tools but pwmd has a couple of distinguishi
147 \begin_layout Itemize
148 It does not depend on a desktop environment but has the ability for applications
149 to connect to it like a desktop solution provides.
152 \begin_layout Itemize
153 Some portion of a stored data can be shared with another portion in the
155 This feature behaves a lot like a symbolic link on a file system, XML entities,
156 or HTML targets if you're familiar with those, but implemented in a different
158 This means less duplication of content.
160 \begin_inset CommandInset ref
162 reference "sec:Linking-elements"
169 \begin_layout Itemize
170 The XML document is OpenPGP encrypted and signed using an existing or newly
172 Symmetric encryption is also supported as well as smartcards.
173 All crypto operations are done using GpgME which in turn uses gnupg.
176 \begin_layout Standard
177 Other features include:
180 \begin_layout Itemize
182 More than one client may access the same data file while optionally locking
186 \begin_layout Itemize
187 Secure memory management.
188 Pwmd will zero out memory before freeing it and the contents of the cached
189 document are encrypted.
192 \begin_layout Itemize
193 Remote connections over TLS with client certificates used as authentication.
196 \begin_layout Itemize
197 Remote connections over SSH (some configuration needed).
200 \begin_layout Itemize
201 ACL's for each element in an element path, listening socket and filename.
204 \begin_layout Section
205 File Format and Element Paths
208 \begin_layout Standard
209 The document is in XML format and is manipulated by commands sent from a
211 Commands that access previously stored data take what is called an
216 An element path is a character string containing element names representing
217 branches of an element tree.
218 The branches are separated with a TAB (ASCII 0x09) character.
219 Why a TAB? So other characters can be used in the element name.
220 If for example a '/' were used as the separator, then a URL (i.e., http://sf.net/)
221 could not be used as an element name since it would be an XML syntax error.
222 For the rest of this tutorial, when you see <TAB>, replace it with a real
226 \begin_layout Standard
227 For example, the element path "root<TAB>child<TAB>last" has the following
228 element tree structure:
244 Content or XML CDATA of the "last" element.
259 \begin_layout Standard
260 I should say that the XML structure that pwmd uses is a little more complicated.
261 It really looks like the following internally, but we will use the above
262 format in this tutorial for simplicity:
266 <element _name="root">
270 <element _name="child">
274 <element _name="last">
278 Content or CDATA of the "last" element.
293 \begin_layout Standard
294 Every element created has an element named
307 attribute is what an element in an element path refers to.
308 It is done this way so that a wider range of characters can be used in
309 an element name while maintaining valid XML.
310 In fact the only restriction of an element name is that it not contain
311 whitespace characters.
314 \begin_layout Standard
315 There is one other difference from your normal XML document in that only
316 the first match of an element is considered for the current element tree
318 When an element of the current depth of an element tree is found, the next
319 element in the element path is searched for beginning at the child node
320 of the found element.
321 From the example above:
337 Content or XML CDATA of the "last" element.
353 This element will never be reached.
364 \begin_layout Standard
365 The second "<child>" element is never reached because it has the same name
366 as its sibling element
367 \begin_inset Quotes eld
371 \begin_inset Quotes erd
377 \begin_layout Section
381 \begin_layout Standard
386 client to send commands to the pwmd server.
391 includes a client named
396 It is command-line based and there are not any fancy graphics, but it is
397 good for understanding how
401 commands are processed.
402 If you want a more user friendly client that resembles a file manager and
403 has a point and click interface, try QPwmc
407 \begin_layout Plain Layout
408 http://qpwmc.sourceforge.net/
413 which uses the Qt4 or Qt5 toolkit and is also a full featured client.
416 \begin_layout Standard
417 In this tutorial we will use the
421 client included with libpwmd.
426 has two modes that commands are read from: interactive and stdin.
427 The interactive mode uses the readline library and has command history,
428 while reading from standard input (stdin) makes shell scripting and automation
430 For the examples, we will be connecting to the default local unix domain
431 socket (UDS) that pwmd waits for connections on and use interactive mode.
432 Remote connections are also possible over TLS or an SSH channel but those
433 are not covered here.
434 Read the pwmc(1) manual page for details about how to do that.
437 \begin_layout Standard
438 The example filename we will use is "datafile".
439 It is initially a non-existent file but it will be created once we have
441 Now let us connect to the server in interactive mode and open the data
457 \begin_layout Standard
458 The "pwmc>" prompt is a readline prompt that has command history and can
459 also do filename completion when doing a dot command that requires a filename
460 on the local filesystem.
463 \begin_layout Section
467 \begin_layout Standard
468 There are two different types of commands: client commands and protocol
470 The client commands are
474 specific and only available to the
479 Protocol commands are commands sent from any client and to the
484 All pwmc client commands are prefixed with a dot '.' followed by the command
486 Protocol commands are sent without any dot prefix.
487 To see the available pwmc and protocol commands, send the .help or HELP
495 \begin_layout Standard
503 \begin_layout Standard
504 To store some data in an element path or to create an element path, you
505 will need to know what element path to create.
506 It is up to you how you want your data organized.
507 If for example you will be storing account information it may be good to
508 categorize what the account is for: email, instant messaging, blogging,
510 An application that uses libpwmd may require that a certain element path
512 Refer to that applications documentation to determine what element paths
516 \begin_layout Standard
517 In the following example we will setup mail server element paths which can
518 be used for other applications requiring a mail server configuration.
519 First, lets create the hostname element path:
527 Press CTRL-D to send the current line.
532 \begin_layout Standard
533 The STORE command is a
538 This, and a few other commands, use what is called a
542 to retrieve additional command parameters from the client while other commands
543 require only the command itself with its command arguments.
544 The server inquire will wait for the client to finish sending its' data
545 before completing the command.
546 When responding to a server inquire in pwmc, pwmc will show a message informing
547 you that it is waiting for data to be sent.
548 Enter the element path and its content, then press <CTRL-D> twice to finish
549 sending the data and to let
553 complete the command:
557 email<TAB>isp<TAB>IMAP<TAB>hostname<TAB>imap.server.com<CTRL-D><CTRL-D>
560 \begin_layout Standard
561 Remember that you should replace <TAB> in the examples with a real TAB character.
562 After pressing the first <CTRL-D>, the characters that were entered are
567 and the inquire continues.
568 To terminate the inquire and finish sending data for the command press
569 <CTRL-D> a second time.
572 \begin_layout Standard
573 If you were to have pressed <RETURN> before any <CTRL-D> then the inquired
574 line would have been sent in full including a newline character.
575 Since in this example a newline character in a hostname is not a valid
576 hostname, this is not what we want.
579 \begin_layout Standard
580 We have just created an element path whose XML structure looks like the
597 <hostname>imap.server.com</hostname>
612 \begin_layout Standard
613 The GET protocol command returns the value, or content, of the last element
615 To retrieve the hostname of the element path we just created, do:
619 pwmc:datafile> GET email<TAB>isp<TAB>IMAP<TAB>hostname
630 \begin_layout Standard
631 Let us create the rest of the needed elements:
639 email<TAB>isp<TAB>IMAP<TAB>port<TAB>993<CTRL-D><CTRL-D>
651 email<TAB>isp<TAB>IMAP<TAB>ssl<TAB>1<CTRL-D><CTRL-D>
663 email<TAB>isp<TAB>username<TAB>myusername<CTRL-D><CTRL-D>
675 email<TAB>isp<TAB>password<TAB>mypassword<CTRL-D><CTRL-D>
678 \begin_layout Standard
679 Now the element structure for the "email" element looks like this:
695 <hostname>imap.server.com</hostname>
711 <username>myusername</username>
715 <password>mypassword</password>
726 \begin_layout Standard
727 If you wanted to change your password (after changing it on the mail server,
728 of course) just do as you did when initially creating the password element
730 The new content will overwrite the existing content:
738 email<TAB>isp<TAB>password<TAB>newpassword<CTRL-D><CTRL-D>
745 \begin_layout Standard
746 An application using libpwmd that requires mail server information now has
747 the basic information it needs.
748 It may require more elements and they can be created just as these elements
750 The only thing left to do now is to save the changes:
754 pwmc:datafile> <CTRL-D>
757 \begin_layout Standard
758 After pressing <CTRL-D> a prompt will be shown asking what to do next.
760 \begin_inset Quotes eld
764 \begin_inset Quotes erd
767 to save what we have created.
768 This will generate a new encryption and signing key pair by default.
769 If you would rather use an existing encryption and signing key or use symmetric
770 encryption, you will need to use the .save pwmc command along with the required
771 SAVE protocol command options.
772 The .save command lets libpwmd set some things that may be needed for the
773 current connection such as pinentry settings.
778 pwmc:datafile> help save
781 \begin_layout Standard
782 to see SAVE syntax and options.
785 \begin_layout Standard
786 When the save has completed the encrypted data file has been written to
787 disk and is also stored in pwmd's file cache.
788 A cached document is the same document on disc that is stored in memory.
789 This means that the next time the document is opened a passphrase won't
790 be required until pwmd's cache timer removes it from the cache.
791 By default, the cache timeout for each data file is 600 seconds, or 10
793 This setting can be changed in pwmd's configuration and set independently
794 for each file and can also be set to not cache the file at all or to cache
798 \begin_layout Section
799 \begin_inset CommandInset label
801 name "sec:Linking-elements"
808 \begin_layout Standard
809 One distinguishing feature of pwmd is the ability to share data of one element
811 If for example your ISP lets you host a blog on their server and you use
812 a blogging client that can use libpwmd for authentication details, you
813 can share authentication information with the email example above when
814 the account details are the same.
815 When element linking is used, this avoids the need to change the content
816 for both the blogging and email password elements.
819 \begin_layout Standard
820 This is done by setting a special
821 \begin_inset Quotes eld
825 \begin_inset Quotes erd
828 attribute for an element.
829 It behaves similarly to the HTML
830 \begin_inset Quotes eld
834 \begin_inset Quotes erd
837 attribute or XML entities or a symbolic link on a filesystem.
841 \begin_layout Standard
842 Let's create an example blogging element path:
850 blog<TAB>isp<TAB>hostname<TAB>blog.myisp.com<CTRL-D><CTRL-D>
858 pwmc:datafile> ATTR SET target blog<TAB>isp<TAB>username email<TAB>isp<TAB>usern
863 pwmc:datafile> ATTR SET target blog<TAB>isp<TAB>password email<TAB>isp<TAB>passw
867 \begin_layout Standard
868 Now each access of the "blog/isp/username" and "blog/isp/password" element
869 paths, which were created if they did not already exist, will point to
870 "email/isp/username" and "email/isp/password", respectively.
871 To retrieve the value or content of an element that contains a "target"
872 attribute, just use the GET command as you would for any other element:
876 pwmc:datafile> GET blog<TAB>isp<TAB>password
887 \begin_layout Standard
888 A "target" attribute may also refer to another element with a "target" attribute.
889 Every "target" attribute will be followed until there are no others to
891 To get the real element path and resolve all "target" attributes, use the
892 REALPATH protocol command:
896 pwmc:datafile> REALPATH blog<TAB>isp<TAB>password
900 email<TAB>isp<TAB>password
907 \begin_layout Standard
908 Using the LIST command is useful to show the element structure of a document:
924 pwmc:datafile> LIST email
936 email<TAB>isp<TAB>username
940 email<TAB>isp<TAB>password
944 email<TAB>isp<TAB>IMAP<TAB>hostname
948 email<TAB>isp<TAB>IMAP<TAB>port
952 email<TAB>isp<TAB>IMAP<TAB>ssl
956 pwmc:datafile> LIST blog
968 blog<TAB>isp<TAB>hostname
972 blog<TAB>isp<TAB>username
976 blog<TAB>isp<TAB>password