This is an old revision of the document!

secret-tool

Store and retrieve passwords from the keyring.

Description

From man secret-tool

Each password is stored in an item. Items are uniquely identified by a set of attribute keys and values. When storing a password you must specify unique pairs of attributes names and values, and when looking up a password you provide the same attribute name and value pairs.

Install

sudo apt install libsecret-tools

Usage

Flags

--label = Mainly for GUI programs but can be used to retrieve a given secret.
{attribute} = Used by the secret-tool for retrieving or deleting a given secret.
{value} = Used by the secret-tool for retrieving or deleting a given secret.

Add an entry

secret-tool store --label='My Label' {attribute} {value} {attribute2} {value2} [...]
Password:

Get a password

secret-tool lookup {attribute} {value} {attribute2} {value2} [...]
P4s$W0rd

Show entries with simialr key/values

secret-tool search --all {attribute} {value} {attribute2} {value2} [...]
[/org/freedesktop/secrets/collection/TestDB/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx]
label = test2
secret = P4s$W0rd
created = 2020-05-08 17:58:08
modified = 2020-05-08 21:16:04
schema = (null)
attribute.Path = /test2
attribute.Uuid = 04706d96b2404a2f96de02a8a76bf113
attribute.UserName = chuck
attribute.URL = 
attribute.Notes = 
attribute.Title = test2
attribute.Key1 = Value1
attribute.Key2 = Value2

Delete an entry

secret-tool clear {attribute} {value} {attribute2} {value2} [...]
# Popup from KeePassXC: 
Do you really want to move entry "test2" to the recycle bin?
                                            <MOVE> <CANCEL>

Additional search terms

Can create values and search them:

secret-tool search --all Title name
secret-tool search --all UserName name
secret-tool search --all URL https://www.url.com
secret-tool search --all Notes value
secret-tool search --all {attribute} {value} [...]

Tips

Set an alias in ~/.bash_aliases:

alias get_password1='secret-tool lookup {attribute} {value} {attribute2} {value2}'

Use in docker:

# "The operator can set any environment variable in the container by using one or more -e flags"
docker run -it --rm \
  -e AWS_ACCESS_KEY_ID=$(aws-key-id) \
  -e AWS_SECRET_ACCESS_KEY=$(aws-key-secret) \
  local/aws-shell

From here: https://www.marian-dan.ro/blog/storing-secrets-using-secret-tool/

Chuck Nemeth

Table of Contents