Mutt: how to safely store password?

My .muttrc file looks something like this one or see below a glimpse. I am hesitant with the password. How should I store my password to use it with mutt?

set imap_user = "<a href="https://getridbug.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="a0d5d3c5d2cec1cdc5e0c7cdc1c9cc8ec3cfcd">[email protected]</a>"
set imap_pass = "password"

set smtp_url = "smtp://<a href="https://getridbug.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="aedbddcbdcc0cfc3cbeeddc3dade80c9c3cfc7c280cdc1c3">[email protected]</a>:587/"
set smtp_pass = "password"
set from = "<a href="https://getridbug.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="becbcddbccd0dfd3dbfed9d3dfd7d290ddd1d3">[email protected]</a>"
set realname = "Your Real Name"

Answers:

Thank you for visiting the Q&A section on Magenaut. Please note that all the answers may not help you solve the issue immediately. So please treat them as advisements. If you found the post helpful (or not), leave a comment & I’ll get back to you as soon as possible.

Method 1

This tweak should get rid of your problem. Use gpg as suggested, or

set imap_pass=`getpassword email_id`

where you use pwsafe or passwords to fetch the passwords.

Edit: If mutt is built with IMAP support (–enable-imap), then mutt should prompt you for the password if you do not set it in the config file. From the manual:

imap_pass

Type: string Default: “”

Specifies the password for your IMAP
account. If unset, Mutt will prompt
you for your password when you invoke
the fetch-mail function. Warning: you
should only use this option when you
are on a fairly secure machine,
because the superuser can read your
muttrc even if you are the only one
who can read the file.

Method 2

Create a passwords file: ~/.mutt/passwords:

set imap_pass="password"
set smtp_pass="password"

This file can be encrypted using GPG. First, create a public/private key pair:

$ gpg --gen-key

Encrypt the passwords file:

$ gpg -r <a href="https://getridbug.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="d2abbda7a0fcb7bfb3bbbe92b7aab3bfa2beb7fcb1bdbf">[email protected]</a> -e ~/.mutt/passwords
$ ls ~/.mutt/passwords*
/home/user/.mutt/passwords   /home/user/.mutt/passwords.gpg
$ shred ~/.mutt/passwords
$ rm ~/.mutt/passwords

Add to your muttrc:

source "gpg -d ~/.mutt/passwords.gpg |"

via

See also Arch Wiki’s Mutt entry.

Method 3

Why not use a wallet manager like gnome-keyring or kwalletmanager with secret-tool?

apt install gnome-keyring secret-tool

.[neo]muttrc:

source 'echo "$( pw=$( secret-tool lookup user <USERNAME> domain <DOMAIN> ); echo set imap_pass="$pw"; echo set smtp_pass="$pw" )" |'

Store your imap and smtp passwd:

secret-tool store --label=imap user <USERNAME> domain <DOMAIN>

You could choose your own label if you wanted to.

Look up your creds using a shell:

secret-tool lookup user <USERNAME> domain <DOMAIN>

Fire up your [neo]mutt, connect & login to your imap srv. Enjoy.

This solution has advantages over gpg-based ones: it integrates well and there’s no additional file left layin’ around.

Bonus: Use libsecret or directly gnome-keyring as a git credential-helper as in git with libsecret and git with gnome-keyring. Both helpers need manual compilation. Yes, it’s a bit awkward but it is working great.

Method 4

To store your imap password safely in GNOME Keyring

put

source ~/.muttrc-retrieve_password |

in your .muttrc with .muttrc-retrieve_password like

IMAP_PASS=$(secret-tool lookup user john_doe host mail.example)
echo "set imap_pass='$IMAP_PASS'"

where you need secret-tool to be installed via

$ apt-get install libsecret-tools -y

and the corresponding entry created like

$ secret-tool store --label=mutt user john_doe host mail.example service imap

at least for mutt 1.9.4 @ ubuntu bionic.

Update: Instead of source you may directly put the line

set imap_pass=`secret-tool lookup --label=mutt user john_doe host mail.example`

into .muttrc (mark the backticks!)

Method 5

You can read the password from an unencrypted file.

For example, put the password into ~/secrets/mail_pass:

the_secret_mail_password

Then

chmod 600 ~/secrets/mail_pass

In your muttrc:

# Read the password from a file and set it
set smtp_pass=`cat ~/secrets/mail_pass`

Method 6

Based on ShreevatsaR’s comment, I want to emphasize security.
If password in $HOME/.muttrc, do

chmod go-r $HOME/.muttrc

However, I think this is not a secure option still.
You should use some method which uses salt in storing passwords.

All methods was sourced from stackoverflow.com or stackexchange.com, is licensed under cc by-sa 2.5, cc by-sa 3.0 and cc by-sa 4.0