4

Is there a way to have getmail get the password from a gpg encrypted file instead of leaving it in plain text?

3 Answers 3

2

Yes you can.

Add your key to gpg-agent or gnome-keyring, and configure either gpg -d or pass to write to stdout without prompting for key unlock. Mind to only include the password in the file. In ~/.getmail/getmailrc:

password_command = ("/usr/bin/pass","email/gmail.pw")

I installed getmail 5.5 from the official website instead of using the ubuntu-xenial repo (4.48) to get the password_command working.

3
  • The first command should be gpg -dq to avoid addition output.
    – Toothrot
    Apr 2, 2018 at 19:41
  • The 2nd argument depends on the current directory. For some reason, ~ will not work, it seems one must supply an absolute path.
    – Toothrot
    Apr 3, 2018 at 8:03
  • for gpg this seems to be the case. With pass, the second parameter is relative to its PASSWORD_STORE_DIR
    – wbob
    Apr 4, 2018 at 8:21
2

As far as I understand, getmail can get the password from

  1. from the password configuration item in the getmailrc file,
  2. from the OS X keychain (on macOS only),
  3. on systems with Gnome keyring support, from the default Gnome keyring,
  4. if not found via any of the above methods, getmail will prompt for the password when run.

(reference: http://pyropus.ca/software/getmail/configuration.html)

It seems to me that storing the password in a GnuPG encrypted file will require you to decrypt the file (using your GnuPG passphrase) and then somehow feed that into getmail while not storing it in a plain text file in-between (possibly using expect?).

It would be simpler, and less prone to accidentally leaving your mail password unencrypted somewhere, to just have getmail prompt you for the mail password (option 4 above).

0
1

I know this is an old question, but here is an update in case anyone comes across it. For the record, it's not always convenient or even feasible to type passwords — so this is a legitimate question. Users may have many accounts and run things from cron jobs.

The correct way to securely manage passwords was through gnome-keyring. I say "was" because everyone seems to have upgraded to a new python library called "keyring". python-gnomekeyring isn't even available on Ubuntu anymore. Unfortunately, getmail has not updated its dependencies — and simply complains that --store-password-in-gnome-keyring is not a valid option when it can't find it. As of now, there is no safe way to manage passwords with getmail. Of course, since Python 2 now is deprecated, and getmail is written in Python 2, it's days are numbered. There does not appear to be a viable alternative, though.

It's odd how the more advanced technology gets, the less we seem to be able to to do with it :)

1
  • Probably because everyone is happy with their Whatsapps, Slacks and Jiras and so on. Less and less people use email, and those who do, probably just stick to the Outlook their employer provides them.
    – mcnesium
    Nov 23, 2020 at 17:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .