Secure CLI Passwords with Keychain Services on Mac OS X

Creating a Password

Dump a password into keychain. I'm using the creator/kind codes "asbl" for Ansible, but you can use any 4 character code. It's useful for doing lookups later.

$ security add-generic-password -a "root" -c "asbl" -C "asbl" -D "Ansible Vault" -s "ansible secrets" -w "secret123password456"

From man security:

-a account     Match account string
-c creator      Match creator (four-character code)
-C type         Match type (four-character code)
-D kind         Match kind string
-G value        Match value string (generic attribute)
-j comment      Match comment string
-l label        Match label string
-s service      Match service string

Note that the "service" shows up as the "where" field in keychain, label "shows" up as "name". Nice work on that UX consistency Apple.

Recalling a Password

You can pull out that password by matching on the params you supplied. Going by service name I could do:

$ security find-generic-password -s "ansible secrets" -w

The -w option causes only the password to be printed.

It's useful to know that you can specify any combination of parameters when extracting passwords and security will take the first match. That's useful if you have multiple gmail accounts. You can specify -s "GMail" on both and the -l "work" and -l "home" on another. When extracting you can get the work one by using security find-generic-password -l "work" -s "GMail".

A Note about Ansible

In the case of ansible we need to pass a file, so we can make a simple wrapper script that will "do the right thing" for us and then pass that as the vault-password-file option. Create a script called vault_from_keychain.sh and chmod +x it, the content should be:

#!/bin/sh
exec security find-generic-password -s "hipyard-ansible secrets" -w

Finally, you can use it in ansible as a command line argument:

$ ansible-playbook Hipyardweb.yml -i inventory/production/hosts -t use_secrets --use-password-file vault_from_keychain.sh

Using it

I have this in my mutt configuration files to store passwords settings (e.g. mutt)

…
set smtp_pass = `security find-generic-password …`
…

but you can also use it to pass data as a CLI parameter

$ someapp dosecurething -user="myusername" -password=`security find-generic-password…`

Warnings

When passing a password as a CLI parameter it will be visible in the process list. Be careful using this kind of thing in this fasion:

$ bundle exec ruby foo_server.rb --user=foobar --password=`security find-generic-password …`

As your password will appear if somebody runs ps aux |grep foo_server

Likewise, you're going to be asked by keychain to allow access to a password item. Once you've allowed a process in iterm to access that password "Always", you're going to allow any future processes to access that item too. Approve foo.rb and bar.rb will be able to read that item too. You probably want to store any truely secret passwords in a seperate keychain vault that isn't unlocked by default if you want it to be protected from malicious processes running under your user account.