feat: Add support for YubiKeys with KeePassXC

[twpayne]

Fixes #3440.

[halostatue]

Looks promising.

[twpayne]

This PR, in theory, adds YubiKey support to chezmoi's KeePassXC support. Refs #2002.

@MathieuDR @isindir would you be able to test this? You'll need to add something like this to your config file:

[keepassxc]
    args = ["--yubikey", "1:7370001"]
    mode = "open"
    prompt = false

For more information, see the changes to the documentation in this PR.

If needed, you can download a chezmoi binary from the most recent GitHub Actions run on this PR. Go to checks, click on main on the left, and then scroll to the bottom of the page. Sadly, GitHub does not make it possible to provide a direct link.

[isindir]

Hello, I have quickly tried following config:

keepassxc:
  database: "/Users/username_redacted/path_redacted/file_name_redacted.kdbx"
  #args: ["-y", "2"]
  args: ["--yubikey", "2:serial_redacted"]
  mode: "open"
  prompt: false

commented args are the ones I have used with version v2.42.2.
new args were used with downloaded version v2.42.3-SNAPSHOT-a97edf1aa
And it failed with the following error (some parts are redacted):

chezmoi: template: private_dot_redacted/redacted.tmpl:2:3: executing "private_dot_redacted/redacted.tmpl" at <keepassxcAttribute "redacted/chezmoi/redacted/store" "obj_id_redacted">: error calling keepassxcAttribute: /Users/redacted/homebrew/bin/keepassxc-cli show /Users/redacted/path_redacted/file_name_redacted.kdbx redacted/chezmoi/redacted/store --attributes obj_id_redacted --quiet --show-protected: exit status 1

I also have tried to comment out mode in config, with the same result.
It shows light on yubikey, after touch it disappears and chezmoi errors.
The template content is similar to:

{{ keepassxcAttribute "redacted/chezmoi/redacted/store" "obj_id_redacted" }}

[twpayne]

Thanks for testing - I don't have a YubiKey available and so can't test easily.

What is the output of:

$ /Users/redacted/homebrew/bin/keepassxc-cli \
    --yubikey 2:serial_redacted \
    /Users/redacted/path_redacted/file_name_redacted.kdbx \
    open

I'm particularly interested in the prompt that keepassxc-cli gives when using a YubiKey.

[twpayne]

Note to self: this line is for debugging and should be removed.

[isindir]

% keepassxc-cli open --yubikey=2:redacted /Users/redacted/path_redacted/filename_redacted.kdbx                                                                                                                                                                                                        
Enter password to unlock /Users/redacted/path_redacted/filename_redacted.kdbx:
filename_redacted>

After entering password it opens prompt, but I have not noticed any yubikey activity.

keepassxc-cli version is 2.7.6

[twpayne]

How do you normally use keepassxc-cli with a YubiKey?

[twpayne]

Are the --no-password and --key-file=$KEY_FILE flags also required?

[isindir]

I'm normally using it with UI, after attempts to configure YK with chezmoi I have not tried it any more tbh.

If I remember correctly, I was trying to configure it in a way, so that a single touch would trigger fetch of all the data when needed.

The command which is used under the hood of chezmoi I believe is something like follows:

keepassxc-cli show -y="2" /Users/redacted/path_redacted/file_name_redacted.kdbx redacted/chezmoi/redacted/store --attributes id_redacted --show-protected --quiet

which silently waits for password and once entered shows me data. If I omit --quiet flag it shows me password prompt:

Enter password to unlock /Users/redacted/path_redacted/file_name_redacted.kdbx:

and after entering correct password prints data to stdout.

Without Yubikey inserted, it fails.

This is how I use it now Indirectly.

[isindir]

If I try to use it with --no-password, I'm getting the following error:

Error while reading the database: Invalid credentials were provided. Please try again.
If this reoccurs, your database file may be corrupt. (HMAC mismatch)

I think I configured DB to require both password and YK. And it feels now that current set of tools works correctly. Maybe no need to change the code. Also, I'm not using key file as auth method.

[twpayne]

Great! Thanks for testing! In the case of needing both a password and a YubiKey, you'll need to remove the prompt: false line from your config. I'll update the docs to reflect this.

[isindir]

With v2.42.2 I'm using:

keepassxc:
  database: "path/file.kdbx"
  args: ["-y", "2"]

Where 2 is the YK slot, and it works for me with both YKs configured in DB file.

[MathieuDR]

@twpayne Does this still need further testing? Thank you so much for this already 🎉!

[twpayne]

@MathieuDR if you could check that it works for you, that would be fantastic!

[MathieuDR]

@MathieuDR if you could check that it works for you, that would be fantastic!

I'll try to do it by this evening

[halostatue]

LGTM, but I don't use keepassxc or have yubikeys, so…

[halostatue]

I would reword this a bit:

If your database is not password protected, add `--no-password` to `keepassxc.args` and `keepassxc.prompt = false`:

It might be nice for keepassxc that if prompt = false, --no-password is automatically added (and just from a configuration perspective, if there were a yubikey configuration field, it would automatically add --yubikey {{ .keepassxc.yubikey }} to the params).

[twpayne]

Thanks, wording updated.

For the automatic detection of prompt, this would require chezmoi to parse keepassxc-cli's arguments the same way that keepassxc-cli does, which is likely to be fragile. I think it's OK to require the user to specify both the arguments and the configuration variable for now.

[admodev]

Great feature, i had the same issue with the --no-password but it was because keepass was configured to use both, a password and Yubikey for auth.