1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
|
# Passman
Passman is a full featured password manager.
[](https://travis-ci.org/nextcloud/passman)
[](hub.docker.com/r/brantje/passman/)
[](https://www.codacy.com/app/brantje/passman?utm_source=github.com&utm_medium=referral&utm_content=nextcloud/passman&utm_campaign=Badge_Grade)
[](https://www.codacy.com/app/brantje/passman?utm_source=github.com&utm_medium=referral&utm_content=nextcloud/passman&utm_campaign=Badge_Coverage)
[](https://scrutinizer-ci.com/g/nextcloud/passman/?branch=master)
## Contents
* [Screenshots](https://github.com/nextcloud/passman#Screenshots)
* [Features](https://github.com/nextcloud/passman#features)
* [External apps](https://github.com/nextcloud/passman#external-apps)
* [Security](https://github.com/nextcloud/passman#security)
* [Password generation](https://github.com/nextcloud/passman#password-generation)
* [Storing credentials](https://github.com/nextcloud/passman#storing-credentials)
* [Support passman](https://github.com/nextcloud/passman#support-passman)
* [API](https://github.com/nextcloud/passman#api)
* [Docker](https://github.com/nextcloud/passman#docker)
* [Maintainers](https://github.com/nextcloud/passman#main-developers)
* [Contributors](https://github.com/nextcloud/passman#contributors)
## Screenshots
For more screenshots: [Click here](http://imgur.com/a/giKVt)
## Features:
- Vaults
- Vault key is never sent to the server
- Credentials are stored with 256 bit AES (see [security](https://github.com/nextcloud/passman#security))
- Ability to add custom fields to credentials
- Built-in OTP(One Time Password) generator
- Password analyzer
- Share passwords internally and via link in a secure manner.
- Import from various password managers:
- KeePass
- LastPass
- DashLane
- ZOHO
- Clipperz.is
- EnPass
- [ocPasswords](https://github.com/fcturner/passwords)
For a demo of this app visit [https://demo.passman.cc](https://demo.passman.cc)
## Tested on
- NextCloud 10 / 11
- ownCloud 9.1+
## External apps
- [Firefox / chrome extension](https://github.com/nextcloud/passman-webextension)
- [Android app](https://github.com/nextcloud/passman-android)
## Supported databases
- SQL Lite*
- MySQL / MariaDB*
*Tested on travis
Untested databases:
- pgsql
## Security
### Password generation
Passman features a build in password generator.
Not it only generates passwords, but it also measures their strength using [zxcvbn](https://github.com/dropbox/zxcvbn).
Generate passwords as you like
Passwords are generated using the random functions from `sjcl`.
### Storing credentials
All passwords are encrypted client side using [sjcl](https://github.com/bitwiseshiftleft/sjcl) which uses AES-256 bit.
Users supply a vault key which is feed into sjcl as encryption key.
After the credentials are encrypted they are send to the server, there they will be encrypted again.
This time using the following routine:
- A key is generated using `passwordsalt` and `secret` from config.php *so back those up*
- Then the key is [stretched](http://en.wikipedia.org/wiki/Key_stretching) using [Password-Based Key Derivation Function 2](http://en.wikipedia.org/wiki/PBKDF2) (PBKDF2).
- [Encrypt-then-MAC](http://en.wikipedia.org/wiki/Authenticated_encryption#Approaches_to_Authenticated_Encryption) (EtM) is used for ensuring the authenticity of the encrypted data.
- Uses openssl with the `aes-256-cbc` ciper.
- [Initialization vector](http://en.wikipedia.org/wiki/Initialization_vector) (IV) is hidden
- [Double Hash-based Message Authentication Code](http://en.wikipedia.org/wiki/Hash-based_message_authentication_code) (HMAC) is applied for verification of the source data.
### Sharing credentials.
Passman allows users to share passwords (this can be turned off by an administrator).
## API
For developers Passman offers an [api](https://github.com/nextcloud/passman/wiki/API).
## Support Passman
Passman is open source, and we would gladly accept a beer (or pizza!)
Please consider donating
- [PayPal](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=6YS8F97PETVU2)
- [Patreon](https://www.patreon.com/user?u=4833592)
- [Flattr](https://flattr.com/@passman)
- bitcoin: 1H2c5tkGX54n48yEtM4Wm4UrAGTW85jQpe
## Code reviews
If you have any improvements regarding our code.
Please do the following
- Clone us
- Make your edits
- Add your name to the contributors
- Send a [PR](https://github.com/nextcloud/passman/pulls)
Or if you're feeling lazy, create an issue, and we'll think about it.
## Docker
To run Passman with [Docker](https://www.docker.com/) you can use our test docker image.
You have to supply your own SSL certs, self signed or Let's encrypt it doesn't matter.
Please note that the docker is only for testing purposes, as database user / password are hardcoded.
If you like to spiece up our docker image and make it a full fledged secure, production ready install, you're welcome to do so.
Please note that:
- Port 80 and 443 are used
- SSL is enabled (or disabled if certs not found)
- Startup time of container must be less than 15 seconds
Example:
```
docker run -p 8080:80 -p 8443:443 -v /directory/cert.pem:/data/ssl/cert.pem -v /directory/cert.key:/data/ssl/cert.key brantje/passman
```
If you want a production ready container you can use the [Nextcloud docker](https://hub.docker.com/_/nextcloud/), and install passman as an app.
## Development
Passman uses a single `.js` file for the templates. This gives the benefit that we don't need to request every template with XHR.
For CSS we use SASS so you need ruby and sass installed.
`templates.js` and the CSS are built with `grunt`.
To watch for changes use `grunt watch`
To run the unit tests install phpunit globally, and setup the environment variables on the `launch_phpunit.sh` script then just run that script, any arguments passed to this script will be forwarded to phpunit.
## Main developers
- Brantje
- Animalillo
## Contributors
Add yours when creating a [pull request](https://help.github.com/articles/creating-a-pull-request/)!
- None
## FAQ
**Are you adding something to check if malicious code is executing on the browser?**
No, because malicious code could edit the functions that check for malicious code.
|
