Document how to automate Keepassxc with keepassxc-cli more

[tieong]

Hey,

My use case is pretty common I think, I have multiple passwords that I need to retrieve from the database in a non interactive manner for programs like mbsync.

I browsed the official doc and stumbled upon keepassxc-cli which seemed perfect, I have a cli that looks like this in my mbsyncrc:

PassCmd "keepassxc-cli show -sa password "

It works but since I have multiple accounts, I'm getting prompted for the database password multiple times which isn't very practical.

I browsed the github issues to know what my options are:

• echo "database-password" | keepassxc-cli ...
• Use secret-tools to automatically feed the database password to keepassxc-cli
• Use keepassxc client(python, rust...) that leverage the browser integration, so that once you have your database that is open via the GUI, your program can just fetch the password it needs.
• Store the master password in GPG and feed it into keepassxc-cli
  ...

I would love to see these in the official docs, explaining what the trade off are for each approach, recommended approach.. , right now using secret-tools seems to be my best bet?

In my personal use case, I don't mind getting prompted, I just need to figure out how to make mbsync retrieve all the passwords it needs in one go and then make them available to the different account that needs this.

[droidmonkey]

Generally speaking "use cases" are better for blogs and niche user sites. We have pending documentation for secret service itself.

[MAMedici]

Bumping this. I'm developing a script to export the Bitwarden vault to an encrypted .json and would like to add the ability to import into a new KeepassXC database. I see no documentation about CLI database creation, setting the master password and keyfile, or importing data into said database.

Are these functions unavailable, or just not documented?

[droidmonkey]

A new feature request will need to be open with all the details

[michaelk83]

@MAMedici https://github.com/keepassxreboot/keepassxc/blob/develop/docs/man/keepassxc-cli.1.adoc is the manpage source for their CLI. You can find there the options to db-create, add entry, etc.

[MAMedici]

Thank you, @michaelk83, that might be worth experimenting. But I think that adding 600 entries one at a time via bash or powershell would be quite inefficient, especially since the input would need to be converted from .json. And the input .json would need to be in plain text, which for would be rightfully considered a vulnerability in the process.

Is this what KeepassXC is doing behind the scenes using when importing encrypted .json from the menu (e.g., writing the .json in plaintext then adding each entry one at a time?) Because the import menu option seems much faster than that.

[michaelk83]

Existing import don't use the CLI AFAIK, they just run directly in the main app in C++. You asked about "documentation about CLI database creation" etc.

If you have access to python or similar, you could decode the json in memory. You could even call the CLI from a C++ client. It still won't be the most secure or efficient solution, but it's another option.

[droidmonkey]

We will port more import options to CLI soon