0

I have followed the following link: Mutt: how to safely store password?

Not sure what i am missing, but not working the way I need it to. Here is what I notice

when I got to the shell prompt and type in mutt it will pop up a screen for me to enter passphrase once I enter it the mail client will pop-up and I can send and receive email with no issues. If I close it and do it again it will not ask for passphrase, however if I close completely out and ssh back into the sever and type mutt it will ask for passphrase.

What I a trying to accomplish is encrypting the password so that when I run a cronjob it will have no issues and bypass being asked for passphrase. Can someone please assist me with getting this to work?

0

There are several different options with different levels of security, so lets outline some of the options so you can make the best decision. To automate decryption, a passphrase has to be stored somewhere (on disk, in memory, or on another machine). It is usually worth considering:

  • Who has access to the machine?
  • Is it publicly accessible or host a publicly accessible service?

Option 1: Store the email passphase unencrypted in your muttrc file.

Limit the read access of muttrc to the user running the cron and encrypt the underlying file system. Since your are using Gmail, create an App Password that can be rotated/revoked if it is compromised. This is probably the easiest solve for the problem.

The downside of this solution, the root user or anyone with sudo privileges can access this file. You can configure sudo to require a password to help reduce that possibility.

Option 2: Store the gpg passphrase unencrypted in a file.

For this option, you are configuring mutt to run gpg non-interactively. Read access should be restricted for your mutt passwords and gpg passphrase files. You should also encrypt the underlying filesystem to protect against physical access. This only adds obscurity to just storing a password unencrypted in the muttrc. The same downsides apply, and this solution would be considered equally secure.

For gpg to be run by a non-interactive user, you will need to run gpg commands with:

  • --batch to disable interactive mode
  • --passphrase-file to provide a password for the gpg private key
  • --pinentry-mode loopback to redirect pinentry queries back to the caller.

So, in the mutttrc:

source "/usr/local/bin/gpg -d --batch --passphrase-file=$HOME/.passFile.txt --pinentry-mode loopback $HOME/.mutt/passwords.gpg |"

Option 3: Use a secrets management service.

No real standard exists in this space, and there are many options in this space. A secrets management service centralizes the management of secrets providing auditing and control of access to secrets at scale. Advantages and disadvantages will change dependent on your deployment and implementation, and going any further into this space would be largely opinion based.

Additionally, here is another question that largely touches on the question domain that might be helpful.

19
  • Thanks for getting back to me in regards to this. so how do I bypass the passphrase from popping up when I use mutt. I did follow the instructions in that link. I did add this line to muttrc file "source "gpg -d ~/.mutt/passwords.gpg |" I think were my problem is that it is the encryption password is not getting stored and may not be tied to user session not sure though.
    – Donny
    Apr 7 '20 at 19:22
  • @Donny Updated the response with the necessary config changes. Automating encryption means you have to store a passphrase somewhere.
    – nickdew
    Apr 7 '20 at 20:47
  • Thanks @nickdew I will give this a shot today and let you know.
    – Donny
    Apr 8 '20 at 13:56
  • I add that line above to my .muttrc it looks as it does not ask for passphrase, but now when typing mutt from the shell I get this -- Password for something.reports@domain.com@imap.gmail.com:
    – Donny
    Apr 8 '20 at 16:37
  • Once I put the password in I can see the mutt inbox and send and receive emails, however need to not have to put this password in or the cronjob will not run.
    – Donny
    Apr 8 '20 at 16:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.