author | Olivier Brunel
<jjk@jjacky.com> 2023-08-20 14:48:20 UTC |
committer | Olivier Brunel
<jjk@jjacky.com> 2023-08-20 14:55:39 UTC |
parent | ed1328920c89d6de044290160e572c1f27ec7a4f |
src/doc/include/show-entry.md | +5 | -0 |
src/doc/ssp-add.1.md | +50 | -0 |
src/doc/ssp-edit.1.md | +52 | -0 |
src/doc/ssp-export.1.md | +38 | -0 |
src/doc/ssp-get.1.md | +82 | -0 |
src/doc/ssp-import.1.md | +34 | -0 |
src/doc/ssp-list.1.md | +72 | -0 |
src/doc/ssp-remove.1.md | +23 | -0 |
src/doc/ssp-rename.1.md | +20 | -0 |
src/doc/ssp-show.1.md | +85 | -0 |
src/doc/ssp.1.md | +109 | -11 |
diff --git a/src/doc/include/show-entry.md b/src/doc/include/show-entry.md new file mode 100644 index 0000000..78ae9c2 --- /dev/null +++ b/src/doc/include/show-entry.md @@ -0,0 +1,5 @@ +! INFO: +! Afterwards, the entry will be shown. This is done by re-opening the database +! and processing the entry as via `ssp show <entry>` +! As such, it can serve as a confirmation that the database was successfully +! edited. diff --git a/src/doc/ssp-add.1.md b/src/doc/ssp-add.1.md new file mode 100644 index 0000000..e1ed7f1 --- /dev/null +++ b/src/doc/ssp-add.1.md @@ -0,0 +1,50 @@ +% ssp +% ssp-add(1) + +# NAME + +ssp-add - add an entry + +# SYNOPSIS + +*ssp* add [OPTION..] `ENTRY` `SECRET` + +# DESCRIPTION + +The *add* command allows to add a new entry to an existing database, or to +create a new database. + +`ENTRY` must be the entry's name, that will be used to identify the +newly-created entry. + +`SECRET` must be the entry's secret, encoded in base32. + +Unless *--time* is used, the new entry will be set to be counter-based. Unless +set with *--algo*, the hashing algorithm is SHA1. + +<inc show-entry.md> + +# OPTIONS + +: *-a*, *--algo* `ALGO` +:: Set `ALGO` as hashing algorithm; Defaults to sha1. Use `list` to list +:: available algorithms. + +: *-C*, *--comments* `COMMENTS` +:: Set `COMMENTS` as the entry's comments. + +: *-c*, *--counter* `NUM` +:: Set entry to be counter-based (HOTP) with the next counter value to be `NUM` +:: Defaults to 1. + +: *-d*, *--digits* `NUM` +:: Set to return an OTP of `NUM` digits. Valid values are from 5 to 9 (both +:: included); Defaults to 6. + +: *-t*, *--time*[=`SECS`] +:: Set entry to be time-based (TOTP) with a precision of `SECS` seconds. Valid +:: values are from 10 to 59 (both included); Default to 30. + +# SEE ALSO + +[ssp-edit](1), [ssp-remove](1) diff --git a/src/doc/ssp-edit.1.md b/src/doc/ssp-edit.1.md new file mode 100644 index 0000000..b9a04e1 --- /dev/null +++ b/src/doc/ssp-edit.1.md @@ -0,0 +1,52 @@ +% ssp +% ssp-edit(1) + +# NAME + +ssp-edit - edit an entry + +# SYNOPSIS + +*ssp* edit -e `ENTRY` `OPTION`[..] + +# DESCRIPTION + +The *edit* command allows to edit an existing entry, updating one or more fields +at a time. + +<inc show-entry.md> + +! HINT: +! The *edit* command does not allow to rename an entry. To do so, refer to the +! *rename* command instead. + +# OPTIONS + +: *-a*, *--algo* `ALGO` +:: Set `ALGO` as hashing algorithm; Defaults to sha1. Use `list` to list +:: available algorithms. + +: *-C*, *--comments* `COMMENTS` +:: Set `COMMENTS` as the entry's comments. + +: *-c*, *--counter*[=`NUM`] +:: Set entry to be counter-based (HOTP) with the next counter value to be `NUM` +:: Defaults to 1. + +: *-d*, *--digits* `NUM` +:: Set to return an OTP of `NUM` digits. Valid values are from 5 to 9 (both +:: included); Defaults to 6. + +: *-e*, *--entry* `ENTRY` +:: Edit the entry `ENTRY`. This option is required. + +: *-s*, *--secret* `SECRET` +:: Set `SECRET` to be the entry's secret. `SECRET` must be base32-encoded. + +: *-t*, *--time*[=`SECS`] +:: Set entry to be time-based (TOTP) with a precision of `SECS` seconds. Valid +:: values are from 10 to 59 (both included); Default to 30. + +# SEE ALSO + +[ssp-add](1), [ssp-rename](1), [ssp-remove](1) diff --git a/src/doc/ssp-export.1.md b/src/doc/ssp-export.1.md new file mode 100644 index 0000000..93ff160 --- /dev/null +++ b/src/doc/ssp-export.1.md @@ -0,0 +1,38 @@ +% ssp +% ssp-export(1) + +# NAME + +ssp-export - export entries + +# SYNOPSIS + +*ssp* export [`OPTION`..] [`PATTERN`] + +# DESCRIPTION + +The *export* command allows to export existing entries. Note that the exported +entries will obviously feature their secrets, and as such should be handled with +care. + +Entries are exported to *stdout* in an INI-like format. Secrets are written as +base32-encoded strings, comments (if featured/any) are written in between +double-quotes (`"`) are escaped as per the rules described for arguments in +[ssp](1). + +By default, all entries from the database are exported. If `PATTERN` is +specified however, only matching entries will be exported. +Refer to [ssp-list](1) for more on pattern matching. + +! INFO: +! The *export* command is merely an alias for the *list* command with its +! *--format* option. Refer to [ssp-show](1) for more about the actual format. + +# OPTIONS + +: *-C*, *--no-comments* +:: Do not export entries' comments. + +# SEE ALSO + +[ssp-list](1), [ssp-show](1) diff --git a/src/doc/ssp-get.1.md b/src/doc/ssp-get.1.md new file mode 100644 index 0000000..fad401e --- /dev/null +++ b/src/doc/ssp-get.1.md @@ -0,0 +1,82 @@ +% ssp +% ssp-get(1) + +# NAME + +ssp-get - get a One-Time Password + +# SYNOPSIS + +*ssp* get -e `ENTRY` | -s `SECRET` [`OPTION`..] + +# DESCRIPTION + +The *get* command is the "main" command, as it's the one allowing you to get a +One-Time Password (OTP). Other commands are mainly about database/entries +management. + +Usually you will want to get an OTP for an existing entry, using its parameters +as set in the database. However, it is possible to override such values using +command-line options. + +You can also get an OTP without using any entry, and therefore without the need +for a database, by specifying all the needed settings via command-line options. + +As such, you need to specify at least one of *--entry* or *--secret*. Other +options are optional and only needed to override entry/default values. + +By default the password will be written to *stdout* with either "HOTP: " or +"TOTP: " as prefix, depending on whether it is a counter-based or time-based +password, respectively. + +To remove said prefix and only have the generated password itself written out, +use general option *--quiet*. + +# OPTIONS + +: *-a*, *--algo* `ALGO` +:: Use `ALGO` as hashing algorithm; Defaults to sha1 unless *--entry* is used. +:: Use `ssp add --algo=list` to list available algorithms. + +: *-C*, *--counter-val* `NUM` +:: Same as *--counter* but don't update entry in the database. + +: *-c*, *--counter*[=`NUM`] +:: Return a counter-based password (HOTP) using `NUM` as value for the counter; +:: Defaults to 1. +:: Note that when using an entry (specified via *--entry*) the entry will be +:: updated in order to increment its counter value (unless the entry is /not/ +:: counter-based). If for some reason you want the database/entry /not/ to be +:: updated, use *--counter-val* instead. + +: *-d*, *--digits* `NUM` +:: Return an OTP of `NUM` digits. Valid values are from 5 to 9 (both +:: included); Defaults to 6 unless *--entry* is used. + +: *-e*, *--entry* `ENTRY` +:: Get a password for `ENTRY`. This means the database will be looked for an +:: entry named `ENTRY` and its settings will be used as default. Any option +:: specified on command-line /after/ will then override said values. +:: In other words, any options given /before/ *--entry* will be ignored. +:: +:: Additionally, when the entry is counter-based, the database will be updated +:: with the entry's counter value incremented (unless *--counter-val* was used). +:: +:: (Note that if the entry is /not/ counter-based but *--counter* is used, the +:: database will obviously not be updated, leaving the entry as it was, e.g. +:: time-based.) + +: *-s*, *--secret* `SECRET` +:: Use `SECRET` as secret. `SECRET` must be base32-encoded. Note that this can +:: be used after *--entry* in order to use a different secret but keep/re-use +:: all other settings as defaults, or it can be used /instead/ of *--entry* to +:: get a password without using an entry/database at all. + +: *-T*, *--use-time* `TS` +:: Use `TS` as unix timestamp instead of the current time. This only applies +:: when getting a time-based password. + +: *-t*, *--time*[=`SECS`] +:: Return a time-based password (TOTP) using a precision of `SECS` seconds. +:: Valid values are from 10 to 59 (both included); Default to 30 unless *--entry* +:: is used. diff --git a/src/doc/ssp-import.1.md b/src/doc/ssp-import.1.md new file mode 100644 index 0000000..2d923b6 --- /dev/null +++ b/src/doc/ssp-import.1.md @@ -0,0 +1,34 @@ +% ssp +% ssp-import(1) + +# NAME + +ssp-import - import entries + +# SYNOPSIS + +*ssp* import `FILE` + +# DESCRIPTION + +The *import* command allows to import existing entries in INI-like format into a +new or existing database. + +The expected format from `FILE` is the same as generated with the *export* +command; Refer to [ssp-show](1) (option *--format*) for more. + +! NOTE: +! You cannot use *stdin* for imported data since it will be used to get the +! database's password. +! +! If you want to use a program's output as data to be imported without using a +! temporary file, a solution might be process substitution. +! +! For example, it could look like this: +! `ssp import <(someprog --export)` +! +! Refer to your shell's manual for actual syntax. + +# SEE ALSO + +[ssp-export](1) diff --git a/src/doc/ssp-list.1.md b/src/doc/ssp-list.1.md new file mode 100644 index 0000000..f4fc45e --- /dev/null +++ b/src/doc/ssp-list.1.md @@ -0,0 +1,72 @@ +% ssp +% ssp-list(1) + +# NAME + +ssp-list - list entries + +# SYNOPSIS + +*ssp* list [`OPTION`..] [`PATTERN`] + +# DESCRIPTION + +The *list* command allows to list existing entries. + +By default, all entries from the database are listed. If `PATTERN` is specified +however, only matching entries will be exported. + +Pattern matching is performed by checking whether the entries' name match the +given `PATTERN`, which must be a shell wildcard pattern, as per [fnmatch](3). + +This means you can use a question mark (`?`) to indicate one character exactly, +and a star (`*`) to indicate zero, one or more characters. Remember that those +shall most likely be escaped from your shell in order to be passed as-is to +*ssp*. + +By default only the entries' names are listed (written in between double-quotes +and escaped as per the escaping rules for arguments described in [ssp](1)), +using a newline (`\n`) as separator. + +You can use a different separator using *--sep*, or have the full entries' be +shown using *--details*. + + +# OPTIONS + +: *-C*, *--no-comments* +:: Do not export entries' comments. Only applies with *--details* or *--format*. + +: *-d*, *--details* +:: Show entries' details. Instead of only listing entries' names, show details +:: of each matching entries. +:: Note that by default secrets will /not/ be written out; specify *--secret* +:: in order to include them as well. + +: *-e*, *--escape-comments* +:: Write comments within double-quotes (`"`) and escaped as per the escaping +:: rules described in [ssp](1) for arguments. Implies *--details*. + +: *-f*, *--format* +:: Output a list in INI-like format. Refer to [ssp-show](1) for more on the +:: actual format. +:: +:: Much like with *--details* this will show details of each matching entries, +:: but unlike *--details* secrets /will be/ included. +:: +:: This is mainly intended for exporting data, and in fact the *export* command +:: is an alias for `list --format` + +: *-S*, *--secret* +:: Show entries' secrets. Implies *--details*. + +: *-s*, *--sep* `SEP` +:: Use `SEP` as separator instead of the default (a newline). This doesn't apply +:: with *--details* nor *--format*. +:: +:: Note that entries' names are always written within double-quotes (and escaped +:: as per escaping rules described for arguments described in [ssp](1)). + +# SEE ALSO + +[ssp-export](1), [ssp-show](1) diff --git a/src/doc/ssp-remove.1.md b/src/doc/ssp-remove.1.md new file mode 100644 index 0000000..df6a22a --- /dev/null +++ b/src/doc/ssp-remove.1.md @@ -0,0 +1,23 @@ +% ssp +% ssp-remove(1) + +# NAME + +ssp-remove - remove an entry + +# SYNOPSIS + +*ssp* remove `ENTRY` + +# DESCRIPTION + +The *remove* command allows to remove existing entry `ENTRY` from the database. + +! WARN: +! No confirmation will be asked. +! As a safe-guard, unless general option *--quiet* was used, the entry will be +! shown before its removal, including its secret. + +# SEE ALSO + +[ssp-edit](1), [ssp-add](1) diff --git a/src/doc/ssp-rename.1.md b/src/doc/ssp-rename.1.md new file mode 100644 index 0000000..faab2d7 --- /dev/null +++ b/src/doc/ssp-rename.1.md @@ -0,0 +1,20 @@ +% ssp +% ssp-rename(1) + +# NAME + +ssp-rename - rename an entry + +# SYNOPSIS + +*ssp* rename `ENTRY` `NEWNAME` + +# DESCRIPTION + +The *rename* command allows to rename existing entry `ENTRY` to `NEWNAME`. + +<inc show-entry.md> + +# SEE ALSO + +[ssp-edit](1) diff --git a/src/doc/ssp-show.1.md b/src/doc/ssp-show.1.md new file mode 100644 index 0000000..968fcc2 --- /dev/null +++ b/src/doc/ssp-show.1.md @@ -0,0 +1,85 @@ +% ssp +% ssp-show(1) + +# NAME + +ssp-show - show an entry + +# SYNOPSIS + +*ssp* show OPTION[..] `ENTRY` + +# DESCRIPTION + +The *show* command allows to show an existing entry. + +! HINT: +! You can only show one entry at a time, specifying its full name. It is +! possible to show multiple entries via pattern matching using the *list* +! command (and its *--details* option). Refer to [ssp-list](1) for more. + +# OPTIONS + +: *-C*, *--no-comments* +:: Do not export entries' comments. + +: *-e*, *--escape-comments* +:: Write comments within double-quotes (`"`) and escaped as per the escaping +:: rules described in [ssp](1) for arguments. + +: *-f*, *--format* +:: Output a list in INI-like format. See [[FORMAT]] below for more. +:: Implies *--secret* +:: +:: This is mainly intended for exporting data, and is used by the *export* +:: command. + +: *-S*, *--secret* +:: Show entries' secrets (as base32-encoded string). + +# FORMAT + +When using *--format* details of the entry will be shown in an INI-like format, +mainly intended for import/export. + +! HINT: Tip +! You can list more than one entry at a time in the same format using the +! *--format* option of the *list* command and its pattern matching feature. +! +! In order to export all entries from the database, simply use the *export* +! command (which is an alias for `list --format`). + +Therefore, first the name of the entry will be featured within square brackets, +denoting a section name. As such, no double-quotes will be used. However, the +escaping rules (as described in [ssp](1) for arguments) still apply. + +Each setting will then be written on a single line, in a `name=value` form. Here +are the list of names/settings : + +: *algo* +:: Hashing algorithm. Same value as for the *--algo* option. Refer to +:: [ssp-add](1) for more. + +: *digits* +:: Number of digits. + +: *counter* +:: Indicate this is a counter-based password. The value is the next value to be +:: used for said counter. + +: *time* +:: Indicate this is a time-based password. The value is always 1. + +: *precision* +:: The precision for time-based password. + +: *secret* +:: The secret as a base32-encoded string. + +: *comments* +:: Comments associated with the entry, within double-quotes and escaped as per +:: the escaping rules described for arguments in [ssp](1). + +# SEE ALSO + +[ssp-list](1), [ssp-export](1) diff --git a/src/doc/ssp.1.md b/src/doc/ssp.1.md index 9eab108..82145bc 100644 --- a/src/doc/ssp.1.md +++ b/src/doc/ssp.1.md @@ -3,35 +3,133 @@ # NAME -ssp - +ssp - One-Time Password management # SYNOPSIS -*ssp* [*-q*] [*-v*] [*--debug* [[@[`level`]:]+`FD`|`FILE`]] [*-O* [@[`level`]:]+`FD`|`FILE`] +*ssp* [*-q*] [*-D* `FILE`] `<command>` + +# DESCRIPTION + +*ssp* is a simple, fast & secure command-line tool to manage your One-Time +Passwords (OTPs), whether you want to handle them from your computer or as a +backup solution. # OPTIONS +: *-D*, *--database* `FILE` +:: Use `FILE` as database. Defaults to `$HOME/ssp.db` + : *--debug* [[@[`level`]:]+`FD`|`FILE`] <inc autoopt_debug.md> <inc autoopt_logdbg_level.md> <inc opt_help.md> -: *-O*, *--log-file* [@[`level`]:]+`FD`|`FILE` -<inc autoopt_log.md> -<inc autoopt_logdbg_level.md> - : *-q*, *--quiet* <inc autoopt_quiet.md> -: *-v*, *--verbose* -<inc autoopt_verbose.md> - <inc opt_version.md> -# DESCRIPTION +# COMMANDS + +The following commands are available through *ssp*. Note that you can abbreviate +a command's name so long as there's no other match possible. + +: *add* +:: Add a new entry + +: *edit* +:: Edit an existing entry + +: *export* +:: Export entries to file + +: *get* +:: Get a One-Time Password + +: *import* +:: Import entries from file + +: *list* +:: List entries + +: *remove* +:: Remove an entry + +: *rename* +:: Rename an entry + +: *show* +:: Show an entry + +To get more information about any of them and their supported options, refer to +the command's own page ( *ssp-`<command>`* ). + +# HOW TO WRITE ARGUMENTS + +Whenever you need to specify text, such as file/entry names or comments, the +same rule apply. + +There are no restrictions of length or acceptable characters imposed by *ssp* +(e.g. file names obviously need to be valid filenames, i.e. no slashes or NUL +byte). +Specifically, inputs are treated as byte streams and processed as such. + +Note however that in order to use specific characters, or simply spaces, you'll +need to put argument within double-quotes (`"`). + +## Escaping rules + +Characters with special escaping are as follow : + +: double-quote (`"`) +:: Escaped by prefixing with a backslash (`\`) + +: backslash (`\`) +:: Escaped by prefixing with a backslash (`\`) + +: bell (`0x07`) +:: Escaped as `\a` + +: backspace (`0x08`) +:: Escaped as `\b` + +: tabulation (`0x09`) +:: Escaped as `\t` + +: line feed (`0x0a`) +:: Escaped as `\n` + +: vertical tabulation (`0x0b`) +:: Escaped as `\v` + +: form feed (`0x0c`) +:: Escaped as `\f` + +: carriage return (`0x0d`) +:: Escaped as `\r` + +Additionally, specific bytes can be specified using hex-mode, that is `\x` +followed by its hexadecimal code. (For example, byte 127 would be escaped as +`\x7f`). + +Anything else will be treated as-is. + +# DATABASE + +The database is written as a password-protected file. + +More specifically, PBKDF2-HMAC-SHA3-256 is used with 500,000 iterations to +derive a key from the password and a randomly generated salt, said key is then +used to encrypt the database using ChaCha20-Poly1305. + +Whenever writing to the database, the actual file is not changed. Instead a new +file is created, encrypted data is written to it and only once successfully +written the file is renamed, thusly replacing the original/old one (if any). -*ssp* is... +As such, should any error occur during the (re-)writing process, your current +database file will remain untouched and no data will be lost. <inc bugs.md>