Guidance / Suggestions for KeePassXC sync with phone

General Discussion
, ,
1

Hello,

As I start using QuBes in my daily laptop, I need to maintain my KeePassXC up to date with phone.

Thus, I am reaching out to other more experienced users about their experience in doing so.
There are some other posts on this forum - but, I found these to be very convoluted.

I would hope for some high-levels steps and stragegy to be shared;
thus, facilitating the transition for newbies.

Thanks

1 Like
2

If you don’t mind giving the VM direct network access, you can use Syncthing downloadable through apt, flatpak or as an executable, and Syncthing-Fork on the phone. Don’t modify the database on both devices at the same time and keep regular backups. Use Möbius Sync if iOS. KeePass for Android can be KeePassDX.

1 Like
3

Thanks @tumble

It seems that your ‘Vault’ has full internet access.

I was trying to find a way to avoid giving full network connectivity.

But, if there is no better option - i may have to go with that

1 Like
4

You will need an VM to run syncing software, which needs internet and would already have access to your password database. What is your concern? That the database password will be extracted through the memory? There are guides such as split-syncthing.

edit: depending on setup with Syncthing, firewall rules could be used to limit risk.

1 Like
5

So, the problem is to share some data between your vault qube and a phone?

What’s wrong about manually copying them like this: vault qube → disposable with access to the phone → your phone?

The whole point of Qubes OS is to isolate things so I don’t understand why one would connect a vault qube to the internet.

3 Likes
6

Transfer through USB? The problem is inconvenience. If I create a new login, every time it has to go through the process again. At least using KeePass in this method is more secure than online password managers, who could modify the JS code at any point.

1 Like
7

you could setup a script or small program which exports your keepass db to a vm with a syncthing setup thus avoiding vault having network access if that is something you are worried about and you have the time to implement such a thing. I did not read thoroughly it seems this has already been reccomended.

1 Like
8

i agree here. The purpose of vault is to be airgapped.

What you can do is manually copy the database file to Syncthing VM. And setup syncthing so that /home/user/QubesIncoming/vault is a shared folder.

However you would have to regularly delete the database in vault in syncthing vm before you copy it over because copy to vm wont allow you to copy if the file name matches the same at the destination

1 Like
9

interesting! What would a script like this look like? Im thinking setting up a cron could get the job done

EDIT: I tried a simple bash script but i get a prompt asking for which vm to send it to eventhough i mentioned it in the script. Any way to avoid this?

heres my script

`#!/bin/bash

Copy the keepass.kdbx file to the Syncthing AppVM

qvm-copy-to-vm Syncthing /path/to/keepass.kdbx`

2 Likes
10

Many Thanks for the contributions !

The reason for this question was the inconvenience in trying to keep the KDBX updated via USB which inevitably led to long delays between syncs.

The idea of a script is ideal - but the QuBes security will block the automatic transfers between AppVM.

(!) it would be useful to have a system of API_KEY ( defined in Dom0 ? )
for specific & limited automated tasks btw appvms.

I will try out these suggestion of having this script & Syncthing
perhaps this User Case could be utilised for other purposes too.

Thanks,

1 Like
11

Reduce maintenance to begin with to manually synchronize less often.

12

If you are interested in a completely automatic solution you could implement a system which monitors the file descriptors of your database file/files and or the keepassxc process and when specific state requirements are met such as keepassxc process closes and db file is modified send over your files to the syncthing qube; this may be unnecessarily complex though depending on your needs and time availability.

1 Like
13

I am unaware of an automatic blocking of file transfers between AppVMs. I doubt that the qubes devs would implement such a thing and not enable the user to create exceptions through some kind of configuration mechanism however I openly invite the possibility I am incorrect.

1 Like
14

Thanks for the input @JameriquayJohnsonsen

1 Like