2.2 seed-options options

Options for adding and removing seeds in the configuration file.. The --text option or the --tag option (when by itself) tell the program to manage password "seeds" in its database (configuration file). Both options together add a new seed, and --tag, by itself on the command line, removes a seed.

seed option.

This is the “define a seed for a series of passwords” option. This option takes a hierarchy argument ‘SEED’. This option is not a command line option. It is also the only option that is directly processed from the config file.

The seed values consist of four named parts (sub-options):

‘tag’

These are displayed next to each displayed password to help identify them.

‘text’

This is not displayed, but is used for the SHA initial value. This may be arbitrarily long.

‘ver’

The version of gnu-pw-mgr used to initially store the seed. This is used to determine the password tweaking algorithm to use when the generated password does not meet the site criteria (see section the password character class option). On rare occasions, new character class restrictions may cause a change in the algorithm used to tweak passwords. When this is done, the old algorithm is still used to tweak passwords from the older seeds.

‘shared’

The presence of this sub-option specifies that the seed is only to be used with password ids that are also marked as --shared. Without this sub-option, the seed is only used with password ids that are not marked as --shared.

The way to change a password is to specify the rehash count. It defaults to 10007. You can determine the current value with the --status option.

Specify only the --tag and --text (and maybe --shared) command line options and the program will initialize or insert a new value into the configuration file. Specify only the tag and no other command line arguments, and the associated seed entry will be removed. All passwords using that seed will become unavailable. You cannot remove the last seed.

tag option (-t).

This is the “seed tag” option. This option takes a string argument ‘TAG’.

This option has some usage constraints. It:

• may not be preset with environment variables or configuration (rc/ini) files.
• must not appear in combination with any of the following options: login-id, cclass, length, specials, no-header, pbkdf2.

The tag for a seed to be added to or removed from the config file. The use depends on whether or not there is a --text option.

text option (-s).

This is the “seed text” option. This option takes a string argument ‘TEXT’.

This option has some usage constraints. It:

• may not be preset with environment variables or configuration (rc/ini) files.
• must appear in combination with the following options: tag.

The text for a password seed to be added to the config file. This text cannot include the 7 character sequence "</text>". There must always be at least one. Multiple text seeds will cause multiple passwords to be printed out.

This text must be at least 64 characters long. The expectation is you will write a sentence or two that you can easily remember, including any capitalization, punctuation and spacing. You should include some non-alphabetic, non-digit characters here and there to make a dictionary attack more difficult. But if you need to reconstruct this, you need to remember them.

If the text is shorter than 64 characters, it will be padded out. In such a case, you will need to save the configuration file some place secure or it will be extremely difficult to reconstruct it, should that become necessary.

The original expectation was that passwords would be updated on an occasional basis. Now that I have over 100 login credentials, it is clearly infeasible to go around and update them all. Instead, I have to decide which are important to update and use the --rehash option to change the rehash count. The date of the last rehash count change is recorded with the password id options.

shared option.

This is the “shared tag” option.

This option has some usage constraints. It:

• can be disabled with –no-shared.
• may not be preset with environment variables or configuration (rc/ini) files.

If this option is used on conjunction with the text option, that seed is marked as a shared password seed and derived passwords are only printed for password ids that have been marked as shared. When used in conjunction with a password id, then the password id will be marked as a shared. Passwords will only be printed for seeds and ids that have matching “shared” settings.

This document was generated by Bruce Korb on June 30, 2018 using texi2html 1.82.