Password/Key Management for multiple machines in emacs

Question

I log into numerous machines as part of my job (+- 20 per day). I only spend a few days/weeks with each machine. Many run ftp only.

For seamless access Tramp is amazing, but it is the managing of these server's access by hand that has become tedious.

I manage a .netrc and a .ssh/config by hand, along with any keys. Often a password/key will change during my time with the machine, and I will have to re-edit the files.

Is there an effective solution for managing (machines/passwords/keys) from within emacs?

Answer 1

I use a simple password manager called pass. It offers a simple command line interface with is ideal for integrating with Emacs. The backing store is a GPG encrypted GIT repo. It actually ships with an Emacs package although I don't use it. My interface is laughably simple:

(defun my-fixup-gpg-agent (frame)
  "Tweak DISPLAY and GPG_TTY environment variables as appropriate to `FRAME'."
  (when (fboundp 'keychain-refresh-environment)
    (keychain-refresh-environment))
  (if (display-graphic-p frame)
      (setenv "DISPLAY" (terminal-name frame))
    (setenv "GPG_TTY" (terminal-name frame))
    (setenv "DISPLAY" nil)))

(add-hook 'after-make-frame-functions 'my-fixup-gpg-agent)

;; Simple caching
(defvar my-cached-passwords
  nil
  "Cache of passwords. Stored in plain text so you only want to cache
  them if of low value.")

(defun my-pass-password (pass-name &optional cache)
  "Return the password for the `PASS-NAME'."
  (let ((cached-pass (assoc-default pass-name my-cached-passwords)))
    (if cached-pass
        cached-pass
      (when (selected-frame)
        (my-fixup-gpg-agent (selected-frame))
        (let ((new-pass (chomp
                         (shell-command-to-string
                          (format "pass %s" pass-name)))))
          (when (and new-pass cache)
            (add-to-list 'my-cached-passwords (cons pass-name new-pass)))
          new-pass)))))

Answer 2

Tramp uses the auth-sources backend for managing passwords. It needs some specialized entries in .authinfo, like

 machine melancholia port scp login daniel password geheim

Read the Tramp manual, chapter "Password handling", for details.

auth-sources have also some functionality to create password entries on-the-fly. I've never tried this functionality with Tramp, but maybe you investigate a little bit.