Menu

Use either password or key file to open DB?

Caveman
2010-08-28
2012-11-20
  • Caveman

    Caveman - 2010-08-28

    I use KeePass in a semi-portable setting - copies of the database file reside on my home computers and are synched once a day. I  can reach out and bring a copy from home to an outside location or I can carry it on a secure flash drive. I would very much like to see the ability to unlock the database file with either password or key file (from flash drive) or even by one of the three methods, including by Windows User account.  As I understand it now, I have to use_ ALL_ the defined authentications TOGETHER if more than one is defined.  The goal is to not have to go downstairs or upstairs to get the flash drive to unlock the database whenever I am at home and need to use KeePass (I have injured foot and it really huts to walk stairs and my memory is shot), but to not have to type in the password when I am at a location outside home - I could then use the flash drive key file (different than on which the database is located, of course).  Any ideas how to do that OR having it as a feature would be much appreciated.  Caveman

     
  • develop1

    develop1 - 2010-08-29

    Plugin "KeeAutoExec" might be a reasonable workaround solution for what you are asking for.
    The purpose of this plugin you open up a .kdbx file and upon opening that .kdbx file will then open up other kdbx files for you.

    What you would do is create a gatekeeper .kdbx datafile which contains one and only one record.
    That record will be an autoopen of your real .kdbx file.
    You would have one "gatekeeper" .kdbx file for each authentication method you want to employ.
    Each of these gatekeeper .kdbx files would contain no actual password records
    instead their only purpose is automatically open your real .kdbx file for you.
    Your "real" .kdbx file would be opened by password only and even you would not know this password.
    The only way you could open your real .kdbx file is to go through one of the gatekeper databases.

    Here's how:

    step 1) backup your existing .kdbx file (just as a precaution)

    step 2) install the pluggin.  KeeAutoExec

    step 3) Lets assume your actual .kdbx database file is called
        MYDBS.kdbx
        
    Now create a gatekeeper .kdbx file for every method you wish to have
    It might be easiest on you to name each file for what it does and what you need to make it work.
        MYDBS_WINDOWS_UAC.kdbx
        MYDBS_PASSWORD_AND_KEYFILE.kdbx  (does NOT need to be the same password as the file below)
        MYDBS_PASSWORD_ONLY.kdbx         (does NOT need to be the same password as the file above)

    step 4) close each of the above files and reopen them.
            The point of this is to prove  that you can successfully open each of them
            and that they are setup to enforce what is needed for them to be opened.

    step 5) Using the example above you now have 4 .kdbx files.
            Your real .kdbx database called "MYDBS" and three other .kdbx files which currently are empty.
            
    step 4) use the keypass Generate password utility
            create a string which is really funky, really long and really impossible to remember.
            Feel free to use high ansi characters.
            You never are going to type this password in your life anyway.
            Something like this will be fine:
                 Û»%ÖÎÑîòí,k;/ZùÔ?9Qè?fUxD¹\XÕ}<%lö#åTs±Mn£;¤öÈÍ<ù4  
            put this string in your clipboard as you are going to need to use it a few times
            you might want to temporarily put this string into a un-saved notepad session
            so you can retrieve it in case you accidentally clear your clipboard before we are done needing this string.
                         
    step 5) take your actual mydbs.kdbx file and change it so its opened via a masterpassword ONLY.
            set the master password to that funky value in your clipboard.
           
    step 6) Now go into each of your empty.kdbx files you defined earlier.
            create a new folder called "AutoOpen"
            in this folder create a new entry/record. 
            set the "password" field to the the funky string in your clipboard
            set the "url" field to the fully qualified filename of MYDBS.kdbx
            Repeat this for  each of your gatekeeper databases 

    step 7) Now that you have created an autoopen in each of your gatekeeper databases
            close all your .kdbx files including "mydbs.kdbx"

    step 8) Sit back and enjoy.  Go ahead and open one of Gatekeeper databases such as  MYDBS_WINDOWS_UAC.kdbx
    if all went according to plan without you doing anything other than opening the gatekeeper file
    it automatically opened up your real/actual "MYDBS.kdbx" for you.
    Assuming it did. Go ahead and clear your windows clipboard and close down that unsaved notepad session.   
    as we never will need to look at funky string again.

    At this point no one, NOT even you can directly open your real password database "mydbs.kdbx" 
    The only way you can open up "mydbs.kdbx" is use one of your gatekeeper databases such as MYDBS_WINDOWS_UAC
    When you open up any of your gatekeeper databases that database file will automatically open up your actual mydbs.kdbx file for you. 
    The end result is you always can get into your "mydbs.kdbx" database using whatever authentication method is appropriate for that workstation or situation.

    You now have the effect desired:

    There is one PC that you can open file MYDBS simply by using the windows logon
    yet you can still open MYDBS if you know the password that goes along with the keyfile.
    yet you can still open MYDBS if you know the password when only a password is needed (verus the keyfile password).

     
  • Paul

    Paul - 2010-08-30

    This is a long work around because KeePass cannot use multiple keys - there is only one key that opens the database.
    An alternative would be to store your password in the key file on the USB key. Then the password and key file are the same.

    cheers, Paul

     

Log in to post a comment.

MongoDB Logo MongoDB