3

My password for imap and smtp are the same and mutt version is using integrated smtp settings.

I do not want to store my password in any script nor encrypt it with pgp/openssl nor using wallet password managers. Also, I want exactly:

  • to be asked just once for password
  • same password to be used for imap and smtp (to not be asked again inside same mutt session)

What is best way to achieve this?

My already figured-out solution uses these .muttrc config lines:

set imap_pass=`read -s -p 'mail-password : ' mailpass ; echo $mailpass`
set smtp_pass=$imap_pass

and it is ~OK for my needs. Just because I am new to mutt, I am wondering is there some better way ...

(... like using omitted imap_pass and smtp_pass, which will result in mutt's promting for imap_pass, and than convincing somehow mutt to use same for smtp).

0

while I don't think, that it's secure to read the password into an environment variable,*
I like the way of Aaron Toponce (credits to him: https://pthree.org/2012/01/07/encrypted-mutt-imap-smtp-passwords/):

And that way, you could use mutliple accounts with the same password-file (but,yes, its not recommended to use the same pass for different accounts)


Just the essentials (for explanation see the link above):

First, I created a ~/.mutt/passwords file. The file is in plain text. Before encrypting it, here are its contents:

set imap_pass="password"
set smtp_pass="password"

I then encrypt that file with the following command:

% gpg -r your.email@example.com -e ~/.mutt/passwords
% ls ~/.mutt/passwords*
/home/user/.mutt/passwords /home/user/.mutt/passwords.gpg
% shred ~/.mutt/passwords
% rm ~/.mutt/passwords

The last two commands are to ensure that the temporary file you created for encryption is securely wiped from the disk using the GNU Shred utility. Now, you should only have an encrypted binary data file that contains your passwords. All that is left is to configure Mutt to decrypt them when starting up. You can set that easily in your Muttrc:

source "gpg -d ~/.mutt/passwords.gpg |"

update:
* it's not in an environment-variable, it's in the memory:
quote: Mutt has to store the password somewhere in memory, and it uses a setting which you can query for that. It's not an environment variable, it's mutts memory. Everybody with access to it can get that password. On a stock linux system this is every program running under your user. With sysctl kernel.yama.ptrace_scope = 1 no other program can acess the memory itself. But if an attacker can run code as your user (which he can if he compromises any program) then he can just grab the password when you run gpg.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.