I use KeePass to manage most of my passwords, but I'm currently still storing passwords in cleartext in a few places that I'm not totally comfortable with: + smtp credentials in .muttrc + imap credentials in .offlineimaprc + Nextcloud credentials for caldav /cardav in .vdirsyncer/config

The vdirsyncer docs offer a few suggestions for using pass or keyring, but I got a few steps into the Keyring setup process and realized I'm going to have to do some troubleshooting just to get it working (I'm using Gnome, it is defaulting to a KDE wallet...). Before I go down that rabbit hole, I'm wondering if there's a reliable solution that will work for all three needs.

  • Make an habit of using KeePass
    – user232326
    Dec 29, 2017 at 21:48
  • 1
    Offlineimap can retrieve credentials from gpg files via pass, it is documented on the OfflineImap wiki, IIRC.
    – jasonwryan
    Dec 29, 2017 at 21:49
  • @isaac I'd love to use KeePass for this, but I wasn't able to find any guidance on how to actually use KeePass with vdirsycner, offlineimap, or mutt. If you know more about how I'd go about actually using it for this, I'm all ears.
    – Amanda
    Dec 29, 2017 at 21:55
  • What is your threat model? You could encrypt all or part of your home directory, but that offers no protection while you're logged in. Dec 29, 2017 at 22:47
  • @UlrichSchwarz I'm not sure threat modeling is a useful frame here, but two solid reasons include: a) I think twice about changing passwords when I know I'm going to have to remember to update multiple random config files; b) I'd like to be able to share my config files without editing out passwords every time.
    – Amanda
    Jan 3, 2018 at 18:43

1 Answer 1


I wound up going with pass --

My .vdirsyncer/config uses password.fetch = ["command","pass","Nextcloud/user"] to retrieve the password.

In .offlineimaprc

accounts = Example
pythonfile = ~/.offlineimap/pass.py

[Repository ExRemote]
type = IMAP
remotehost = ...
cert_fingerprint = ...
remoteuser = [email protected]
remotepasseval = get_pass("user")
ssl = yes 

And then .offlineimap/pass.py includes this:

#! /usr/bin/env python2
from subprocess import check_output

def get_pass(account):
    return check_output("pass Example/" + account, shell=True).splitlines()[0]

I'm still fine tuning my .muttrc settings.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .