SECSTORE(1)

okay so this is the SECSTORE(1) page from the General Commands Manual, and it’s giving “three little secret-keeping commands that are lowkey iconic” energy. no cap, bestie, this one is all about auth, secrets, and not losing your fave files 💅

---

🎀 NAME 🎀

aescbc, ipso, secstore — the secstore commands. that’s the whole squad, fr fr.

---

✨ SYNOPSIS ✨

secstore [ -s server ] [ -(g|G) getfile ] [ -p putfile ] [ -r rmfile ] [ -c ] [ -u user ] [ -v ] [ -i ]

aescbc -e <cleartext >ciphertext
aescbc -d <ciphertext >cleartext

ipso [ -a -e -l -f ] [ file ...  ]

---

💖 DESCRIPTION 💖

Secstore authenticates to the server using a password and optionally a hardware token, then saves or retrieves a file. it’s intended to be a credentials store — public/private keypairs, passwords, and other secrets — for a factotum. literally the little vault bestie for your auth stuff 🫶

secstore options, bestie

• -s server — the server is tcp!$auth!secstore, or the server specified by option -s. so you can point it somewhere else if that’s the vibe 💫
• -p putfile — stores a file on the secstore. put that secret away, slay.
• -g getfile — retrieves a file to the local directory. bringing it back home 🎀
• -G getfile — writes it to standard output instead. same retrieval energy, but it goes straight to stdout.
• getfile set to . — specifying getfile of . will send to standard output a list of remote files with dates, lengths and SHA1 hashes. cute little inventory moment ✨
• -r rmfile — removes a file from the secstore. bye bestie, and remember: it’s giving irreversible, so read the BUGS section 😭
• -c — prompts for a password change. new password, new main character energy.
• -u user — yep, it’s in the synopsis as -u user. the page doesn’t spell out extra deets here, so i’m not gonna invent lore. iykyk 💅
• -v — produces more verbose output, in particular providing a few bits of feedback to help the user detect mistyping. honestly obsessed with helpful little feedback 💖
• -i — says that the password should be read from standard input instead of from /dev/tty. stdin girlies rise 🧚
• -n — says that the password should be read from NVRAM (see authsrv(3)) instead of from /dev/tty. NVRAM moment, periodt.

---

the example, because examples ate

for example, to add a secret to the file read by factotum(4), run:

% cd somewhere-private
% auth/secstore -g factotum
secstore password:
% echo 'key proto=apop dom=x.com user=ehg !password=hi' >> factotum
% auth/secstore -p factotum
secstore password:
% cat factotum | 9p write -l factotum/ctl

and delete the window. the middle commands fetch the persistent copy of the secrets, append a new secret, and save the updated file back to secstore. the final command loads the new secret into the running factotum. it’s giving full-circle secret choreography 🌈

---

ipso, the convenient little script bestie

the ipso command packages this sequence into a convenient script to simplify editing of files stored on a secure store. it copies the named files into a private directory, plumbs them to the editor, and waits for a line on the console. once a line is typed, signifying that editing is complete, ipso prompts the user to confirm copying modified or newly created files back to secstore. if no file is mentioned, ipso grabs all the user’s files from secstore for editing. no files named? it’s grabbing the whole stash, bestie 🍓

by default, ipso will edit the secstore files and, if one of them is named factotum, flush current keys from factotum and load the new ones from the file. if the -e, -f, or -l options are given, ipso will just perform only the requested operations, i.e., edit, flush, and/or load. very “pick your own adventure” of it ✨

ipso option tea

• -a — provides a similar service for files encrypted by aescbc (q.v.). with the -a option, the full rooted pathname of the file must be specified and all files must be encrypted with the same key. also with -a, newly created files are ignored. noted, no extra claims, just facts 💅
• -e, -f, -l — if these are given, ipso will just perform only the requested operations, i.e., edit, flush, and/or load. no extra side quests.

---

aescbc, cryptographic icon

aescbc encrypts and decrypts using AES (Rijndael) in cipher block chaining (CBC) mode. that’s the whole flex, and it’s a good one 🔥

---

📦 SOURCE 📦

/bin/ipso
/src/cmd/auth/secstore

---

👀 SEE ALSO 👀

factotum(4), secstored(1). go read those too, bestie, it’s called lore expansion 🦋

---

💀 BUGS 💀

ok this part is serious, bestie. read it before you do anything irreversible.

• there is deliberately no backup of files on the secstore, so -r (or a disk crash) is irrevocable. you are advised to store important secrets in a second location. like, please, fr fr 😭
• when using ipso, secrets will appear as plain text in the editor window, so use the command in private. no screen-sharing your secrets, bestie 🙈
• establishing a private directory in which to store the secret files is difficult on Unix. on most systems, ipso creates a mode 700 directory /tmp/ipso.user and works there. on Linux systems, ipso looks for a tmpfs file system; if it exists, ipso creates the ipso.user directory in its root instead of /tmp. noted, no guessing, just the tea 🫶
• Ipso should zero the secret files before removing them. should. iconic security goal, but that’s what the page says 💅

---

catch u later — signing off from SECSTORE(1), General Commands Manual, with no separate source/version or date line in this copy, just the cute footer vibe and a lil mwah 🎀✨