MDP(1)

✨ mdp(1) — NAME ✨

okay so bestie, this is the manual page for mdp, aka the password safe 💖 (and yes, that's MDP(1), General Commands Manual, if you're keeping score).

🌸 SYNOPSIS 🌸

mdp [-Vh] [-c config] command [arguments ...]

🦋 DESCRIPTION 🦋

mdp is a wrapper around GnuPG and a text editor. That's the whole vibe. It also ships with a full-screen pager that has a timeout (so passwords don't just linger on your screen like an ex who won't leave 👀) and a password generator that works with profiles.

The following options are global and apply to all the subsequent commands:

• -c config — Use an alternate configuration file. slay, custom setup.
• -V — Print version.
• -h — Print general usage. For command-specific usage, this flag should be placed after the command name, for example 'mdp edit -h'. (yes, position matters, she's picky 💅)

👑 COMMANDS 👑

✨ mdp add ✨

mdp add [-h] [-k keyid] [-p profile] [-n count] [-l length] keywords ...

Add passwords to the end of the password file. This command is an alias for 'generate' and 'edit' with the added advantage of not requiring any copy-paste (we love a no-copy-paste queen 🫶). All the arguments to this command will be used as prefix in the password file (with the exception of the options starting with '-').

The options for the 'add' command are the same as the 'edit' and the 'generate' command.

🎀 mdp edit 🎀

mdp edit [-h] [-k keyid]

Edit the password file (decrypt and re-encrypt after the fact). This command creates a temporary file in the same folder as the password file and starts the editor, if the file is changed, the file is fed to GnuPG when the editor exits. honestly iconic behavior.

The only option for the 'edit' command is:

• -k key_id — The argument is a GnuPG key id (8 alpha-numeric characters), it could be used to specify a key id in case it wasn't defined in the configuration file.

💜 mdp generate 💜

mdp generate [-h] [-p profile] [-n count] [-l length]

Generate password(s) according to the configuration or command-line arguments. Without profile specified, mdp uses the top-level definitions for the character set, password length and count (see CONFIGURATION below). All the flags specified on the command-line will override the ones specified in the profile or top-level definitions. This command can be shortened as 'gen'. (gen is the nickname, we're on nickname basis 😌)

The options for the generate command are:

• -p profile — Choose which profile to use among the ones defined in the configuration file.
• -n count — Number of passwords to generate. This command line parameter will override all other values of password_count (global and profile).
• -l length — Length of generated passwords (in characters). This command line parameter will override all other values of password_count (global and profile).

🌈 mdp get 🌈

mdp get [-hEr] keywords ...

Return all the password entries matching the given keywords or regexes (if using -E). By default, this command will open a full-screen pager to display search results, the time the pager remains on screen is adjustable in the configuration file. Note that hitting

ngl bestie the original manpage literally stops at "Note that hitting" and then moves on 😭 that's it, that's the sentence, she left us on a cliffhanger. Not me inventing the rest, because I will NOT — the facts stay facts 💀

The options for the get command are:

• -E — Use regexes instead of plain text matches (e.g. ^.mail).
• -r — Displays the result without pager, plain terminal dump to stdout. This option should be used sparingly since the password will linger on screen and in terminal history/buffer. 🚨 like, actually be careful with this one, it's giving "screenshot your secrets" energy.

🧚 mdp prompt 🧚

mdp prompt [-hE]

Starts a full-screen pager with search prompt. This command is useful to avoid passing the search keywords in the command line (and allowing all users in the system to see what passwords are requested). Since it uses the default pager, multiple searches can be conducted using the '/' key. Any other key will exit the pager, it will also exit after a configurable timer. The search keywords will be interpreted as regexes if the -E option is used (see mdp get).

⭐ QUICK WALKTHROUGH ⭐

1. Create a GPG key if needed.
2. Create a .mdp/config file from the example (with at least gpg_key_id).
3. Either define EDITOR env variable or add editor to the config file.
4. Pick a password from randomly generated ones, for example:

mdp gen

5. Run mdp edit and add a line such as:

twitter sponge@bob.com yHVHPnqXyx6qUuki

6. This is how the Twitter password is requested:

mdp get twitter

🍓 CONFIGURATION 🍓

This is an alphabetically sorted summary of all the available configuration variables and options:

• set backup no — Define whether we keep a backup every time we edit the password file. Default: yes.
• set character_count count — Define how many characters to randomize per password. Default: 16 or as defined in the profile.
• set character_set characters — Define all the characters to use in passwords. Default: all alphanumeric (upper and lower case) or as define in the profile. The following aliases are supported as shortcuts: $LOWERCASE, $UPPERCASE, $ALPHA, $DIGITS, $ALPHANUMERIC, $SYMBOLS, $PRINTABLE.
• set editor path — Command to start the text editor. It's considered better practice to define an $EDITOR environment variable. If mdp detects vim, it will attempt to add the -n parameter to avoid vim from creating swap files.
• set gpg_key_id key_id — GnuPG key id (default: none). If no key is selected, mdp will expect a key specified on the command-line (-k). If no key was specified either way, mdp will abort. That this parameter is ignored during the decryption phase, GnuPG picks the key based on the content of the password file.
• set gpg_path path — GnuPG absolute path (default: /nix/store/zh52w5abnkfrwhcymwpq4ddx87a6y5g3-gnupg-2.4.9/bin/gpg)
• set gpg_timeout seconds — Number of seconds to give GnuPG for password and pipe interaction. The default value is 10 seconds. This will kill GnuPG if forgotten at the password prompt or if it cannot communicate with the parent process.
• set password_count count — Define how many password to show with using 'mdp gen'. Default: 4 or as defined in the profile.
• set password_file filepath — Sets the location of the password file. mdp will refuse to use a password file with permissions other than 0600 or in a folder with permissions other than 0700. The default value for password_file is ~/.mdp/passwords.
• set timeout seconds — This variable define how long the pager will display search results. The default value is 10 seconds. mdp will use your default editor (as defined by $EDITOR).
• profile name — All the variables define below a profile header will be specific to this profile. For now only password_count, character_count and character_set are valid options.

🦄 PASSWORD FILE 🦄

The password file should be structured to allow mdp to query it, since it works similarly to grep, one line per password is ideal. For example:

nameOfServiceA   password1
anotherService   password2

The keywords used for search and the passwords can be separated with anything except for new-line (\n), allowing services to be found by names:

mdp serviceA

Any convenient number of namespacing hints can be used to add hierarchy, the following allows all 'email' passwords to be returned at once:

email     serviceA       password1
email     serviceB       password2
irc       serviceC       password3

Using '#' in the beginning of a line will avoid mdp from displaying this line during searches. This is particularly useful to add meta data to the password file or keep track of previous password without adding noise to the output. For example:

# email services
serviceA     password1
serviceB     password2

# irc servers
serviceC     password3

Empty lines are naturally ignored. (as they should be, we respect a blank line's boundaries 💅)

🔥 SECURITY 🔥

Why not 'shred' the temporary file? If the disk can be stollen, it should be encrypted. Shred has limited use on most journaled file-systems.

What if 'root' cannot be trusted? The machine cannot be trusted if you cannot trust its administrator.

What if my server is virtualized? Same answer as above, if the hosting provider or Iaas cannot be trusted, the machine in their facility cannot be trusted.

fr fr though, that whole section is a vibe check on your threat model. no cap.

🌸 ENVIRONMENT 🌸

• EDITOR — The content of this variable will be used as default editor if the configuration does not alter it.

🎀 FILES 🎀

• $HOME/.mdp/config — Main configuration file for mdp.
• $HOME/.mdp/passwords — Encrypted list of passwords.
• $HOME/.mdp/passwords.bak — This file is a copy of the password file, before the last edit. The current password file can be replaced by the backup to discard the last changes. Setting 'set backup false' in the configuration file disables the creation of the backup file.
• $HOME/.mdp/lock — This file is created while the password file is loaded in the editor. It avoids two copies of mdp to run at the same time for the same user.

🫶 SEE ALSO 🫶

gpg(1), sh(1)

💀 BUGS 💀

• None that we know of. (iconic. flawless. no notes. periodt.)

💖 AUTHORS 💖

mdp was written by Bertrand Janin <b@janin.com> and is distributed under an ISC license (BSD, MIT and OSI compatible).

A bunch of utility functions are borrowed from OpenBSD and OpenSSH, both under ISC and BSD licenses, with copyrights from the following authors:

Copyright (c) 2004 Ted Unangst and Todd Miller
Copyright (c) 1998 Todd C. Miller <Todd.Miller@courtesan.com>
Copyright (c) 2000 Markus Friedl.  All rights reserved.
Copyright (c) 2005,2006 Damien Miller.  All rights reserved.

The random password generator was mostly borrowed from apg (also BSD licensed), with the following copyright notice:

Copyright (c) 1999, 2000, 2001, 2002, 2003
Adel I. Mirzazhanov. All rights reserved

The array and xmalloc libraries are taken from tmux, with the following copyright notices:

Copyright (c) 2004 Nicholas Marriott <nicm@users.sourceforge.net>
Copyright (c) 2006 Nicholas Marriott <nicm@users.sourceforge.net>

---

and that's the whole page bestie 🫶 this MDP(1) entry comes from Debian, dated January 24, 2014 — go forth and keep your passwords safe, mwah 💖✨🎀