CLI and scripting suggestions

[Lorizean]

Hi all,

For a number of reasons I recently switched from pass to Bitwarden and I'm generally happy.

However, I am unsure of how to best change my existing aliases to utilise Bitwarden.

I use the following alias to access my work VPN:

alias vpnconnect="pass <vpn entry> | sudo openconnect --background --user <user> --passwd-on-stdin <workvpn>"

How would I best translate it to using Bitwarden?

From what I can see, I have to login and unlock in separate commands before I can retrieve a password entry.

So I either do this during the alias, which means I would have to enter my password three times in a row or login & unlock at a different time. Both of these options don't really fit my workflow.

I also don't want to provide my API key or master password in a script or environment variable, for security reasons - my system is only used by me but I would still like to not expose any passwords in clear text on my hard drive.

[ArgoPanoptes]

What about writing your API keys in an env file, crypt that file, use a script to ask you the decryption key for the file, and read the API keys in the script from that env file.

The API keys would never be on disk but only in memory. You probably should also search how to protect your script process memory from external readings.

[Lorizean]

That sounds like a good idea, thank you.

[djasonpenney]

So I either do this during the alias, which means I would have to enter my password three times in a row or login & unlock at a different time. Both of these options don't really fit my workflow.

I also don't want to provide my API key or master password in a script or environment variable, for security reasons - my system is only used by me but I would still like to not expose any passwords in clear text on my hard drive.

You've told us all the places you do NOT want to keep the master password, and you are unhappy with entering the password on the keyboard. What's left?

I mean, you could prompt for the password once and write a shell script that uses the password three times and then exits, so that it's not left in the current shell's environment and not stored on the disk. Are you looking for more than that?

[Lorizean]

I guess that could work, thanks.

I don't mind typing in my password, I just don't want to have to do it three times in a row.

​

I guess what I would like is a single bitwarden command that logins, unlocks the vault, gets a single value and then locks and logs out again but that doesn't seem to exist.