4

I spent about a day and a half working through all the various and mostly out of date KeePass option for Ubuntu (Kubuntu). I want to share what I've found and ask for other answers regarding the many approaches and defunct options.

First I wanted to collect the relevant question from this site, several of which are almost a decade old. These are ordered by most votes as that seems to be what Google uses and where I landed first was the top one.

Let me explain my path so far.. Starting in Windows, loved this simple yet powerful lightweight password manager. Never connected it to the web, but kept the DB file inside a Vercrypt container. I was using LastPass because of its good entry field recognition for saving new PWs and the mobile use for $12/yr. Then they doubled the price, and recently again, until its $40/year now.

I have been using KeePasXC on Kubuntu 18.04, because after searching around I thought I might want the browser integration, and it seems to work okay, but I kept searching for the synchronize databases or remove duplicates functions. Its just that XC doesnt have these standard KP features. I dont know why because I believe the KP source code is freely available. Anyway, recently I finally ditched LP and moved to KeePass2Android, which works remarkably well. It syncs to all kinds of cloud services, so I put all the non-important accounts I had in LP into a KP DB and onto Google Drive. (btw, to convert LP to KP, use this field sequence 6,5,2,3,1,4,7).

Now Ive been needing to setup a desktop browser integration using the same db file on Google drive. So searched through all the various forms of KP, KPx, KPxc, KPrpc, Kee, KeeVault and a number of others. Tusk seemed to have the most reviews on the Chrome Store and it does connect with a shared GDrive file. However, it doesnt ask to save any passwords. Plus I really needed a editor that would sync, to delete a few entries I dont want in the cloud anymore. So, I found a plugin for GDrive, but KPxc doesnt use plugins. Too bad because KPxc does have ask to save. The response suggested I use the gdrive-org client, however it appears to no longer connect with error "Sign in with Google temporarily disabled for this app..This app has not been verified yet by Google in order to use Google Sign In." from Google. Other sync clients I tried like grive, have the same error.

So I went back to trying to get the plugins to work again with the error "The plugin cannot be loaded a newer .NET framework is required". Trying mono-complete, wine64 (which has wine32), winetricks with dotnet 4.5, msitools for wine. I tried installing the gsync plugin, tried adding the log4net.dll, read other exhausting and possible fixes, tracked down the error, tried all those fixes. In one of those I found a solution to use Dolphin's network connection to sync the db file, but it had some caveats that are not so smooth. I still couldnt get KP on wine or mono to connect to a cloud.

Reading the official KP documentation, it seems the remote file URl was built mainly for Dropbox. And because the GDrive sync client werent working I pursued DBox. Still couldnt get KP to connect, and even Tusk was failing to connect to it. So back to KPxc, but it turns out because Im using portable Chrome installations in Veracrypt volumes which close automatically on powercut, it wasnt finding the 'proxy' to connect the browser). I very nearly gave up and paid for KeeVault, which is at a noble price point, but read some reviews first and they reminded me how much I dislike trusting a 3rd party for data storage. Granted Gdrive isnt much better, but I will fight using Dbox tooth an nail because their breach exposes several of my email addresses which have led to phishing attacks. At least GDrive is erring on the side of caution per their error message.

Finally, Ive resolved to manually syncing the db file after editing and all I want is a browser integration that asks to save. It turns out that Kee without using KeeVault but using KPrpc which finally has a plugin that works with mono-complete, and has ask-to-save.

So if I've missed any options that fulfil the requirements I've stated, or that does allow syncing to a remote db file automatically on change, please let me know. I see regular KP does have 'triggers' which would start such an action, but if there are no GDrive clients which currently connect, Im at a loss. I did find rclone, which has many cloud config options, and I believe may connect to GDrive, but would need to write a script to integrate them. After all KeePass2Android can connect to GDrive, and it even has an option to only authenticate a connection to a single folder in DBox instead of the whole drive.

Apparently, the following from the other question/answers above are currently unmaintained: Tusk, ChromeIPass, PasslFox.. KeePassHttp may still work, its still in the Chrome Store.

KeePass with KeePassRPC plugin installation is best summed up here: https://askubuntu.com/a/291309/795299 probably derived from here.

sudo apt-add-repository ppa:jtaylor/keepass  
sudo apt-get update  
sudo apt-get install keepass2 mono-complete
sudo mkdir /usr/lib/keepass2/plugins
sudo apt install curl
sudo apt install jq
curl -s https://api.github.com/repos/kee-org/keepassrpc/releases/latest | jq -r ".assets[] | select(.name | test(\"KeePassRPC.plgx\")) | .browser_download_url" | xargs sudo curl -s -L -o "/usr/lib/keepass2/plugins/KeePassRPC.plgx" 

A couple final notes:

6
  • 1
    I hate do say this, because you've put a lot of work into that question and the situation will be different in a couple of weeks, but questions about upcoming, still-unreleased versions are off-topic: askubuntu.com/help/on-topic. That said, one of the strengths of KeePass/KeePassXC is its security from NOT being so tightly integrated with the browsers. I never got mine to work properly and consistently, and ended up migrating to Bitwarden, which was easy (and it syncs between devices).
    – Kurankat
    Apr 19 '20 at 3:17
  • why not keep on running keepass? maybe because of buttercup.pw
    – cmak.fr
    Apr 19 '20 at 5:31
  • No worries @alchemy, to each their own and that's why there are multiple alternatives. BTW you can host your own BW vault, but if you use their cloud service I understand your concerns. It all depends on your threat model.
    – Kurankat
    Apr 19 '20 at 6:17
  • @Kurankat, I was just shocked at the lack of professionalism. Scary to even think my data was threatened, so I do believe they have access to your data, unlike LP which I believe had a message they dont store your master pw, so if you lose it youre sol, showing they have no access to your data as reps. When they were hacked in '15, they exposed only hashed passwords, ..and then they had the browser leak bug. If Im going to host my own, I might as well just use basic KP.
    – alchemy
    Apr 19 '20 at 16:43
  • @cmak.fr, wow, now that is what I was possibly looking for.. looks great. Syncs to clouds, mobile app, browser integration.. what else do you need? I really feel there needs to be a free public option. The code should be public domain by now. Even the hosting cost, for every person in the world, would be trivial. Of course I think only self hosting on a trusted cloud is safe (except for sensitive pws, only locally). Seriously, the whole world needs to get on board. It's essential that everyone uses a password manager to prevent hacking, but also to prevent resources from going to botnets.
    – alchemy
    Apr 19 '20 at 16:58
1

So far I like @cmak.fr's suggestion of ButterCup.pw. I will likely post a review of it here.

There is a pretty good current discussion of BC here, although it seems it now does auto-logout after x minutes and ask to save new: https://www.ghacks.net/2019/07/30/buttercup-open-source-password-manager-windows-macos-linux-firefox-chrome/ Actually, upon install in the desktop app sudo dpkg -i buttercup-desktop_1.19.0_amd64.deb and a couple of glitches, it doesnt find my kdbx file to convert, so maybe I have to put the file in a special dir? There is no file manager to open files. A bit unpolished.

Also, interesting, from the related Chrome extensions of BC.pw is LessPass, which uses a master pw, the site, your login and a length to create a recreateable password. This might be a good option for less important accounts. Although, a targeted attacker might have the site and login from a compromised email. That still leaves the master and length (which would likely be reused) to have to hack. If a login were used perhaps using unique substitution rules for the website address, that might be enough to make it very difficult to hack. That said, it does have the advantage of them being not all stored together.. interesting idea. I suppose the master and length could also be varied by say category of service.

LessPass How Does It Work? - LessPass

Then again, there's nothing like the piece of mind from a very long and random string from a password manager.

EDIT1: Yeah, the more I use the original KP, the more I remember that I was missing basic features like 'Find Duplicates' that can give you a preview before Removing Duplicates sorted based on identical passwords and then alphabetically. Thats useful for syncing (or merging) files from different sources (Google), that might not look like the same entry. Although it looks like any collisions would be stored in history, and they are compared by a 'combination of user name / password' (https://keepass.info/help/v2/sync.html). I also miss having the automatic LastPass (and many more) file import vs manually setting the fields. Auto-type would be nice, and should work on linux, but not for me. https://thelinuxexperiment.com/set-up-keepass-auto-type-on-linux/

EDIT2: Glad to see it helped at least one person. I did get Autotype to work on Linux with both KPXC and KP2 running on Wine (not using a keyboard shortcut setup from the link above). Both still minimize the apps into the background, unlike the original KP on Windows (which I've suggested KPXC change because the Autolock on Minimize feature conflicts with it). KP2 with Wine, the fonts arent great but it works, and autofill works with the Kee Extension for Chrome. And I just make sure I sync any changes to the cloud with KP2 or KP2Android before making more changes to the non-current db file. I just wish I could preview those changes for any potential collisions.

2
  • 1
    Based upon the Buttercup comment above I tried it for several months because I had problems integrating Keepass2 originally. After using BC for 3 months now, I can't stand it. Keepass2 has hit it out of the park. Feature sthat it has that I can't live without are: export to any format (security that you can always go wherever you want to). Search, dups, etc. BC on the other hand seems like a oneway trip since it's export is so basic, does not support much. Interface is not user friendly. About the only thing it does well is work an every platform
    – user147176
    Jul 6 '20 at 20:00
  • 1
    @user147176, yeah, agreed, import/export functionality is about the first thing I look for with any software. Have had to manually export data before and its such a time sink. I think KP works on all platforms now with Wine on Linux and KPXC on Mac.
    – alchemy
    Jul 8 '20 at 1:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.