使用 Bitwarden 和 Podman 管理你的密码
密码 密码管理器
![](/data/attachment/album/201908/03/104545rzd1hrpv0a1wwplf.jpg)


在过去的一年中，你可能会遇到一些试图向你推销密码管理器的广告。比如 [LastPass](https://www.lastpass.com)、[1Password](https://1password.com/) 或 [Dashlane](https://www.dashlane.com/)。密码管理器消除了记住所有网站密码的负担。你不再需要使用重复或容易记住的密码。相反，你只需要记住一个可以解锁所有其他密码的密码。


通过使用一个强密码而​​不是许多弱密码，这可以使你更安全。如果你有基于云的密码管理器（例如 LastPass、1Password 或 Dashlane），你还可以跨设备同步密码。不幸的是，这些产品都不是开源的。幸运的是，还有其他开源替代品。


### 开源密码管理器


替代方案包括 Bitwarden、[LessPass](https://lesspass.com/) 或 [KeePass](https://keepass.info/)。Bitwarden 是一款[开源密码管理器](https://bitwarden.com/)，它会将所有密码加密存储在服务器上，它的工作方式与 LastPass、1Password 或 Dashlane 相同。LessPass 有点不同，因为它专注于成为无状态密码管理器。这意味着它根据主密码、网站和用户名生成密码，而不是保存加密的密码。另一方面，KeePass 是一个基于文件的密码管理器，它的插件和应用具有很大的灵活性。


这三个应用中的每一个都有其自身的缺点。Bitwarden 将所有东西保存在一个地方，并通过其 API 和网站接口暴露给网络。LessPass 无法保存自定义密码，因为它是无状态的，因此你需要使用它生成的密码。KeePass 是一个基于文件的密码管理器，因此无法在设备之间轻松同步。你可以使用云存储和 [WebDAV](https://en.wikipedia.org/wiki/WebDAV) 来解决此问题，但是有许多客户端不支持它，如果设备无法正确同步，你可能会遇到文件冲突。


本文重点介绍 Bitwarden。


### 运行非官方的 Bitwarden 实现


有一个名为 [bitwarden\_rs](https://github.com/dani-garcia/bitwarden_rs/) 的服务器及其 API 的社区实现。这个实现是完全开源的，因为它可以使用 SQLite 或 MariaDB/MySQL，而不是官方服务器使用的专有 Microsoft SQL Server。


有一点重要的是要认识到官方和非官方版本之间存在一些差异。例如，[官方服务器已经由第三方审核](https://blog.bitwarden.com/bitwarden-completes-third-party-security-audit-c1cc81b6d33)，而非官方服务器还没有。在实现方面，非官方版本缺少[电子邮件确认和采用 Duo 或邮件码的双因素身份验证](https://github.com/dani-garcia/bitwarden_rs/wiki#missing-features)。


让我们在 SELinux 中运行服务器。根据 bitwarden\_rs 的文档，你可以如下构建一个 Podman 命令：



```
$ podman run -d \
 --userns=keep-id \
 --name bitwarden \
 -e SIGNUPS_ALLOWED=false \
 -e ROCKET_PORT=8080 \
 -v /home/egustavs/Bitwarden/bw-data/:/data/:Z \
 -p 8080:8080 \
 bitwardenrs/server:latest
```

这将下载 bitwarden\_rs 镜像并在用户命名空间下的用户容器中运行它。它使用 1024 以上的端口，以便非 root 用户可以绑定它。它还使用 `:Z` 更改卷的 SELinux 上下文，以防止在 `/data` 中的读写权限问题。


如果你在某个域下托管它，建议将此服务器放在 Apache 或 Nginx 的反向代理下。这样，你可以使用 80 和 443 端口指向容器的 8080 端口，而无需以 root 身份运行容器。


### 在 systemd 下运行


Bitwarden 现在运行了，你可能希望保持这种状态。接下来，创建一个使容器保持运行的单元文件，如果它没有响应则自动重新启动，并在系统重启后开始运行。创建文件 `/etc/systemd/system/bitwarden.service`：



```
[Unit]
Description=Bitwarden Podman container
Wants=syslog.service

[Service]
User=egustavs
Group=egustavs
TimeoutStartSec=0
ExecStart=/usr/bin/podman run 'bitwarden'
ExecStop=-/usr/bin/podman stop -t 10 'bitwarden'
Restart=always
RestartSec=30s
KillMode=none

[Install]
WantedBy=multi-user.target
```

现在使用 [sudo](https://fedoramagazine.org/howto-use-sudo/) 启用并启动该服务：



```
$ sudo systemctl enable bitwarden.service && sudo systemctl start bitwarden.service
$ systemctl status bitwarden.service
bitwarden.service - Bitwarden Podman container
    Loaded: loaded (/etc/systemd/system/bitwarden.service; enabled; vendor preset: disabled)
    Active: active (running) since Tue 2019-07-09 20:23:16 UTC; 1 day 14h ago
  Main PID: 14861 (podman)
     Tasks: 44 (limit: 4696)
    Memory: 463.4M
```

成功了！Bitwarden 现在运行了并将继续运行。


### 添加 LetsEncrypt


如果你有域名，强烈建议你使用类似 LetsEncrypt 的加密证书运行你的 Bitwarden 实例。Certbot 是一个为我们创建 LetsEncrypt 证书的机器人，这里有个[在 Fedora 中操作的指南](https://certbot.eff.org/instructions)。


生成证书后，你可以按照 [bitwarden\_rs 指南中关于 HTTPS 的部分来](https://github.com/dani-garcia/bitwarden_rs/wiki/Enabling-HTTPS)。只要记得将 `:Z` 附加到 LetsEncrypt 来处理权限，而不用更改端口。




---


照片由 [CMDR Shane](https://unsplash.com/@cmdrshane?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText) 拍摄，发表在 [Unsplash](https://unsplash.com/search/photos/password?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText) 上。




---


via: <https://fedoramagazine.org/manage-your-passwords-with-bitwarden-and-podman/>


作者：[Eric Gustavsson](https://fedoramagazine.org/author/egustavs/) 选题：[lujun9972](https://github.com/lujun9972) 译者：[geekpi](https://github.com/geekpi) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
You might have encountered a few advertisements the past year trying to sell you a password manager. Some examples are [LastPass](https://www.lastpass.com), [1Password](https://1password.com/), or [Dashlane](https://www.dashlane.com/). A password manager removes the burden of remembering the passwords for all your websites. No longer do you need to re-use passwords or use easy-to-remember passwords. Instead, you only need to remember one single password that can unlock all your other passwords for you.

This can make you more secure by having one strong password instead of many weak passwords. You can also sync your passwords across devices if you have a cloud-based password manager like LastPass, 1Password, or Dashlane. Unfortunately, none of these products are open source. Luckily there are open source alternatives available.

## Open source password managers

These alternatives include Bitwarden, [LessPass](https://lesspass.com/), or [KeePass](https://keepass.info/). Bitwarden is [an open source password manager](https://bitwarden.com/) that stores all your passwords encrypted on the server, which works the same way as LastPass, 1Password, or Dashlane. LessPass is a bit different as it focuses on being a stateless password manager. This means it derives passwords based on a master password, the website, and your username rather than storing the passwords encrypted. On the other side of the spectrum there’s KeePass, a file-based password manager with a lot of flexibility with its plugins and applications.

Each of these three apps has its own downsides. Bitwarden stores everything in one place and is exposed to the web through its API and website interface. LessPass can’t store custom passwords since it’s stateless, so you need to use their derived passwords. KeePass, a file-based password manager, can’t easily sync between devices. You can utilize a cloud-storage provider together with [WebDAV](https://en.wikipedia.org/wiki/WebDAV) to get around this, but a lot of clients do not support it and you might get file conflicts if devices do not sync correctly.

This article focuses on Bitwarden.

## Running an unofficial Bitwarden implementation

There is a community implementation of the server and its API called [bitwarden_rs](https://github.com/dani-garcia/bitwarden_rs/). This implementation is fully open source as it can use SQLite or MariaDB/MySQL, instead of the proprietary Microsoft SQL Server that the official server uses.

It’s important to recognize some differences exist between the official and the unofficial version. For instance, the [official server has been audited by a third-party](https://blog.bitwarden.com/bitwarden-completes-third-party-security-audit-c1cc81b6d33), whereas the unofficial one hasn’t. When it comes to implementations, the unofficial version lacks [email confirmation and support for two-factor authentication using Duo or email codes](https://github.com/dani-garcia/bitwarden_rs/wiki#missing-features).

Let’s get started running the server with SELinux in mind. Following the documentation for bitwarden_rs you can construct a Podman command as follows:

$ podman run -d \

--userns=keep-id \

--name bitwarden \

-e SIGNUPS_ALLOWED=false \

-e ROCKET_PORT=8080 \

-v /home/egustavs/Bitwarden/bw-data/:/data/:Z \

-p 8080:8080 \

bitwardenrs/server:latest

This downloads the bitwarden_rs image and runs it in a user container under the user’s namespace. It uses a port above 1024 so that non-root users can bind to it. It also changes the volume’s SELinux context with *:Z* to prevent permission issues with read-write on */data*.

If you host this under a domain, it’s recommended to put this server under a reverse proxy with Apache or Nginx. That way you can use port 80 and 443 which points to the container’s 8080 port without running the container as root.

## Running under systemd

With Bitwarden now running, you probably want to keep it that way. Next, create a unit file that keeps the container running, automatically restarts if it doesn’t respond, and starts running after a system restart. Create this file as */etc/systemd/system/bitwarden.service*:

[Unit] Description=Bitwarden Podman container Wants=syslog.service [Service] User=egustavs Group=egustavs TimeoutStartSec=0 ExecStart=/usr/bin/podman start 'bitwarden' ExecStop=-/usr/bin/podman stop -t 10 'bitwarden' Restart=always RestartSec=30s KillMode=none [Install] WantedBy=multi-user.target

Now, enable and start it [using ](https://fedoramagazine.org/howto-use-sudo/)* sudo*:

$sudo systemctl enable bitwarden.service && sudo systemctl start bitwarden.service

$systemctl status bitwarden.service

bitwarden.service - Bitwarden Podman container

Loaded: loaded (/etc/systemd/system/bitwarden.service; enabled; vendor preset: disabled)

Active: active (running) since Tue 2019-07-09 20:23:16 UTC; 1 day 14h ago

Main PID: 14861 (podman)

Tasks: 44 (limit: 4696)

Memory: 463.4M

Success! Bitwarden is now running under system and will keep running.

## Adding LetsEncrypt

It’s strongly recommended to run your Bitwarden instance through an encrypted channel with something like LetsEncrypt if you have a domain. Certbot is a bot that creates LetsEncrypt certificates for us, and they have a [guide for doing this through Fedora](https://certbot.eff.org/instructions).

After you generate a certificate, you can follow the [bitwarden_rs guide about HTTPS](https://github.com/dani-garcia/bitwarden_rs/wiki/Enabling-HTTPS). Just remember to append *:Z* to the LetsEncrypt volume to handle permissions while not changing the port.

*Photo by **CMDR Shane** on *[ Unsplash](https://unsplash.com/search/photos/password?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText).

## Sam Warfield

Nice I’ve been looking for a replacement for Lastpass!

## Dave Adelphi

Steve Gibson (GRC Research) has developed a robust next generation digital identity tool called SQRL (“squirrel”). It’s an elegant solution to the password problem.

https://www.grc.com/sqrl/sqrl.htm

## Eric Gustavsson

Sounds like an elegant solution, though at this point I doubt it will catch on given it relies on server implementations

## Dave

True. The server implementation is simple, essentially a one-liner. There are about 1,300 SQRL testers out there. Hopefully, some of them have the sway to implement it as an alternative authentication method in some more-than-niche markets.

SQRL, with its trust no one security model and public/private key pairing digital identity system, facilitates a paradigm shift away from the manual login process – a change on par with eliminating urban horse manure.

## alex

SQRL sign-in app for Windows.## svsv sarma

Too many password managers but nothing is safe, secure and simple. I rather use a multi lingual unique pattern than relaying on the system stored password managers.

## Eric Gustavsson

If you want something that’s simple and has been used for over a decade, try KeePass. It’s a file-based password manager that’s very secure

Patterns can be broken more easily than password managers as passwords get leaked from websites regularly

## Simone

pass the Standard Unix Password Manager is best for me

## Joe

Gave Bitwarden a chance after seeing article. Thanks!

## chips

What about gnome keyring/seahorse

## Benjamin

Gnome Seahorse is not really a Password Manager.

## Jesse

What is Gnome Seahorse then?

What about KDE Wallet?

thanks,

JV

## Andy Haninger

I put up with seahorse on my Fedora system for a long time before switching to KeePass after using it at work.

The Seahorse UI does integrate well with the rest of Gnome 3, but that’s about all it has going for it. KeePass allows you to store things like a URL for the site you’re logging in to, notes, attached files, etc, etc. Its database is easily portable to other machines. There may be a way to export/import your Seahorse passwords, but it’s not as simple as copying your .kdb and maybe .key files and bingo you’re done.

Seahorse is supposedly still an active project, but wow is it pokey.

## Sergio

IMHO the best password manager is pass (https://www.passwordstore.org/) which relies on standard tools such as gpg2 and git.

## Thomas Preston

Absolutely, standard tools and text files. I sync mine with macOS and iOS too. I bet there’s an Android client as well.

## Mark McIntyre

I also use pass for my password management. Easy to use CLI, self-hosted git server, and an Android app for mobile convenience make it quite the thing.

## tom

thanks for the article. it provides a nice and concise introduction to managing passwords on remote servers. personally i use pass, too. together with pass-tomb the file structure is encrypted. with pass-git you can push it to remote repos. i store my private key (to unlock the tomb) on an external device that I have to carry around with me. so a server solution seems attractive to me.

what I miss to get your concept fully, is a short explanation and link to the podman docs. i dont know at all what podman is or does and how or why i need it.

## jakfrost

Podman is a container manager, like Docker, but rootless.

## Batisteo

It’s not clear for me how to use it with the Android app and Firefox extension.

## Eric Gustavsson

You can follow this article on Bitwardens website. After you have it hosted you can point it to the domain its hosted under or point it to the IP address https://help.bitwarden.com/article/change-client-environment/