Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm trying to set up OfflineIMAP to authenticate via a gpg encrypted file (that way I can consolidate all my encryption to my gpg-agent process).

From the documentation, it seems the only way to encrypt one's server passwords is to use gnome-keyring (which I'd prefer not to run on my headless server). Is there a way to pipe in my password from a gpg file the way you can with mutt?

I know you can add extra features to offlineimap with the extension python file, but I'm afraid I wouldn't know where to start with that.

share|improve this question
1  
Does this work? –  jasonwryan Jul 29 '12 at 9:04
    
@jasonwryan Link is down? NVM: Correct link. –  jw013 Jul 31 '12 at 21:06
    
That link is a bit misleading. Encrypting files is a good way to prevent people from getting anything useful when they steal your hard drive / computer, but it's only a minor speed bump for a malicious root user on the same box you are logging in on. There are many things a root user could do to get around the encryption. Remember that even X11 forwarding from untrusted machines (e.g. via ssh -X) is not safe. –  jw013 Jul 31 '12 at 21:12
    
I just dump all my password-containing configuration files in an ecryptfs container that mounts when I log in, replace the original with a symlink, and be done with it. –  jw013 Jul 31 '12 at 21:14
1  
show 3 more comments

3 Answers

up vote 1 down vote accepted

Another method of leaving offlineimap running with knowledge of your password, but without putting the password on disk, is to leave offlineimap running in tmux/screen with the autorefresh setting enabled in your ~/.offlineimaprc

You need to add autorefresh = 10 to the [Account X] section of the offlineimaprc file, to get it to check every 10 minutes. Also delete any config line with password or passwordeval.

Then run offlineimap - it will ask for your password and cache it in memory. It will not exit after the first run, but will sleep for 10 minutes. Then it will wake up and run again, but it will still remember your password.

So you can leave a tmux session running with offlineimap, enter your password once, and offlineimap will be fine there after.

share|improve this answer
add comment

I use the following method, which works fairly well:

1) Store your passwords in separate gpg encrypted files. For example ~/.passwd/<accountname>.gpg

2) Create a python extension file with a name of your choosing (e.g., ~/.offlineimap.py), with the following contents:

def mailpasswd(acct):
  acct = os.path.basename(acct)
  path = "/home/<username>/.passwd/%s.gpg" % acct
  args = ["gpg", "--use-agent", "--quiet", "--batch", "-d", path]
  try:
    return subprocess.check_output(args).strip()
  except subprocess.CalledProcessError:
    return ""

3) Modify your .offlineimaprc file to tell it about the python file, and to tell it how to read your passwords

[general]
pythonfile = ~/.offlineimap.py
# ...

[Repository <reponame>]
# add this line for each remote repository
remotepasseval = mailpasswd("<accountname>")

If you have several accounts that get checked simultaneously (separate threads), and you use gpg-agent, then it will ask for you passphrase for each account. I prime the agent by creating a file (echo "prime" | gpg -e -r foo@bar.com > ~/.passwd/prime.gpg), and priming the gpg agent by decrypting this file on launch of offlineimap. To do this, add the following to the end of ~/.offlineimap.py:

def prime_gpg_agent():
  ret = False
  i = 1
  while not ret:
    ret = (mailpasswd("prime") == "prime")
    if i > 2:
      from offlineimap.ui import getglobalui
      sys.stderr.write("Error reading in passwords. Terminating.\n")
      getglobalui().terminate()
    i += 1
  return ret

prime_gpg_agent()
share|improve this answer
1  
This answer works really well. Just make sure you use absolute paths, or the subprocess command won't find the encrypted files. –  Clément B. Feb 27 '13 at 10:42
add comment

Loving the answer from @kbeta. However subprocess.check_output() was only introduced in python 2.7 - so here is a version of offlineimap.py that will work with older versions of python:

import os
import subprocess

def mailpasswd(acct):
    acct = os.path.basename(acct)
    path = "/home/hamish/.passwd/%s.gpg" % acct
    args = ["gpg", "--use-agent", "--quiet", "--batch", "-d", path]
    proc = subprocess.Popen(args, stdout=subprocess.PIPE)
    output = proc.communicate()[0].strip()
    retcode = proc.wait()
    if retcode == 0:
        return output
    else:
        return ''
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.