4

I use a password manager called pass. It asks for the master password upon its first invocation. It appears to cache the master password as to avoid rewriting it. For security reasons, I would like to set a timeout.

I have looked through the pass script in /usr/bin/pass. I have not become wiser from that. My suspicion is that gpg-agent has something to do with it. I tried the answers/comments from here. They did not help.

Question: How do I clear the master password cache?
If it has a built-in timeout, that would be nice. Otherwise it will just be a simple cronjob.

Improve this question

1 Answer 1

Reset to default
5

If you are using gpg-agent all passwords (including the master password) are stored/saved in ~/.password-store.

From the "pass" website:

There will be a nice password input dialog using the standard gpg-agent (which can be configured to stay authenticated for several minutes), since all passwords are encrypted.

gpg-agent manual page:

--default-cache-ttl n  Set the time a cache entry is valid to n seconds.       
The default is 600 seconds. 

--default-cache-ttl-ssh n Set the time a cache entry used for SSH keys 
is valid to n seconds. 
The default is 1800 seconds. 

--max-cache-ttl n  Set the maximum time a cache entry is valid to n seconds. 

After this time a cache entry will be expired even if it has been accessed recently. 
The default is 2 hours (7200 seconds). 

--max-cache-ttl-ssh n Set the maximum time a cache entry used for SSH keys is valid 
to n seconds. After this time a cache entry will be expired even if 
it has been accessed recently. 
The default is 2 hours (7200 seconds).

and ...

gpg-agent.conf

This is the standard configuration file read by gpg-agent on startup. It may contain any valid long option; the leading two dashes may not be entered and the option may not be abbreviated. This file is also read after a SIGHUP however only a few options will actually have an effect. This default name may be changed on the command line (see: [option --options]). You should backup this file.

This will only be read if you actually use gpg-agent. If it is "seahorse" (the default in Ubuntu) gpg-agent is ignored).

So you can put any of the 4 parameters in the configuration file with a time in seconds to keep password valid (that includes the master password since that is also stored in ). To release the passwords you can use echo RELOADAGENT | gpg-connect-agent (see the manual for more options).

Improve this answer
3
  • As I stated: the comments and answers from the linked question did not work. $ echo RELOADAGENT | gpg-connect-agent ERR 103 unknown command
    – user216320
    Aug 14, 2015 at 13:21
  • Using gpg-agent --default-cache-ttl 10 has no effect. It does not request my master password after more than 10 seconds.
    – user216320
    Aug 14, 2015 at 13:22
  • 1
    The reason why $echo RELOADAGENT | gpg-connect-agent results in ERR 103 unknown command is that you have gnome-keyring acting as gpg-agent in your setup, and gnome-keyring doesn't recognize this command. See bugs.launchpad.net/ubuntu/+source/gnome-keyring/+bug/884856 for an explanation on how to stop gnome-keyring from doing this. Specifically look at Pete Stephenson's comment from 2013-02-25.
    – lbo
    Dec 10, 2015 at 19:36

You must log in to answer this question.