passwordcockpit/passwordcockpit

Passwordcockpit is a simple, free, open source, self hosted, web based password manager for teams. It is made in PHP, Javascript, MySQL and it run on a docker service. It allows users with any kind of device to safely store, share and retrieve passwords, certificates, files and much more.

Passwordcockpit is a simple, free, open source, self hosted, web based password manager for teams. It is made in PHP, Javascript, MySQL or MariaDB and it run on a docker service. It allows users with any kind of device to safely store, share and retrieve passwords, certificates, files and much more.

Index

• Index
• Usage
• Permissions
  • Global permissions
  • Folder permissions
• Authentication
  • LDAP
• Encryption
  • Password PIN
• Available docker configurations
• Architecture and technologies
  • Frontend
  • Backend
  • Database
• Security
• Update to a newer version
• Vulnerabilities
• Contribute
  • Screenshots
    • Passwords manager
    • Users manager
    • Mobile design

Usage

Installation is done with docker-compose. Please check out the official install instructions for more information.
Passwordcockpit docker images are provided within its Docker Hub organization.

To start, just copy docker-compose.yml to a folder and setup the configuration as shown in the "Available docker configurations" chapter. Finally run docker-compose up from terminal.

When the service is up, navigate to PASSWORDCOCKPIT_BASEHOST (e.g. https://passwordcockpit.com) and login.

The default username is admin. The system generate the default password: Admin123!, this can be overridden by specifying the PASSWORDCOCKPIT_ADMIN_PASSWORD variable.

Permissions

Global permissions

Each user can have following permissions:

⚫️ Nothing (a normal user)
👥 Create and manage users
📁 Create folders
🗄 Access to all directories
📊 Can view log

Folder permissions

Each folder has a list of associated users with their permissions:

⛔️ No access (A user cannot access a folder to which is not assigned)
👁 Read (A user can read the passwords from a folder to which he is associated)
✏️ Manage (The user can add, modify and delete passwords inside the folder)

Users can be associated to a folder even if they do not have permission from the parent folder.

Authentication

Authentication can be done with database stored password or LDAP.

LDAP

To use LDAP, users must exist in Passwordcockpit. The match of PASSWORDCOCKPIT_LDAP_ACCOUNTFILTERFORMAT is done with the username.

When LDAP is enabled it is no longer possible to modify the profile data, since they will be synchronized at each login.

Encryption

There are 3 levels of encryption:

• Password PIN
• SSL encryption for transfering data to the server
• Database encryption for login informations, passwords and files.

Password PIN

A password can be crypted with a personal PIN in order to hide it from users with "Access to all directiories" permission and from users assigned to the same directory.

Available docker configurations

Container volume	Description	Example
/var/www/html/upload	Contains passwords attached files. It is important to map for making data persistent. Access permissions of the host directory have to be the same as the user who runs docker.	./volumes/upload
/etc/ssl/certs/passwordcockpit.crt	SSL certificate file for HTTPS, used to overwrite the self-signed auto generated file. IMPORTANT: specify read-only to avoid the overwrite of your certificate by the container certificate	./volumes/ssl_certificate/passwordcockpit.crt:/etc/ssl/certs/passwordcockpit.crt:ro
/etc/ssl/certs/passwordcockpit.key	SSL certificate key file for HTTPS, used to overwrite the self-signed auto generated file. IMPORTANT: specify read-only to avoid the overwrite of your certificate by the container certificate	./volumes/ssl_certificate/passwordcockpit.key:/etc/ssl/certs/passwordcockpit.key:ro

Environment variable	Description	Example
PASSWORDCOCKPIT_DEBUG	Enable debugging mode, default value false	true
PASSWORDCOCKPIT_DATABASE_USERNAME	Username for the database	username
PASSWORDCOCKPIT_DATABASE_PASSWORD	Password for the database	password
PASSWORDCOCKPIT_DATABASE_HOSTNAME	Hostname of the database server	mysql
PASSWORDCOCKPIT_DATABASE_DATABASE	Name of the database	passwordcockpit
PASSWORDCOCKPIT_BLOCK_CIPHER_KEY	Key for passwords and files encryption. IMPORTANT: do not lose this key, without it you will not be able to decrypt passwords and files	Q7EeZaHdMV7PMBGrNRre27MFXLEKqMAS
PASSWORDCOCKPIT_AUTHENTICATION_SECRET_KEY	Key for encrypting JSON Web Tokens	zfYKN7Z8XW8McgKaSD2uSNmQQ9dPmgTz
PASSWORDCOCKPIT_BASEHOST	Base host of the Passwordcockpit service	https://passwordcockpit.com
PASSWORDCOCKPIT_SWAGGER	Enable swagger documentation, possible values: enable or disable. If enabled, documentation can be seen here: PASSWORDCOCKPIT_BASEHOST/swagger	enable
PASSWORDCOCKPIT_SSL	Enable SSL, possible values: enable or disable. If enabled the port 4343 will be used, the system will generate a self-signed certificate that can be replaced with the one specified in the volumes configuration. If disabled the port 8080 will be used. Standard ports 80 and 443 are no longer used because the container runs with a non-root user.	enable
PASSWORDCOCKPIT_SSL_RELAXED_IP	When PASSWORDCOCKPIT_SSL is disabled, it can be set hosts where secure rule is relaxed.	10.0.0.1,10.0.0.2
PASSWORDCOCKPIT_ADMIN_PASSWORD	Admin password to log into passwordcockpit	Password123!
PASSWORDCOCKPIT_AUTHENTICATION_TYPE	Type of the authentication, possible values: ldap or password	password
APACHE_RUN_USER	For running the Apache variants as an arbitrary user.	1000
APACHE_RUN_GROUP	For running the Apache variants as an arbitrary group.	1000
PASSWORDCOCKPIT_UPLOAD_ACCEPTED_MIMETYPES	Specify accepted mime types to check when uploading a file, default value 'pdf'	pdf, zip, doc

LDAP variables (only necessary if LDAP is enabled)	Description	Example
PASSWORDCOCKPIT_LDAP_HOST	Hostname of the LDAP server	ldap
PASSWORDCOCKPIT_LDAP_PORT	Port of the LDAP server	389
PASSWORDCOCKPIT_LDAP_USERNAME	Username for LDAP	uid=name,cn=users,dc=passwordcockpit,dc=com
PASSWORDCOCKPIT_LDAP_PASSWORD	Password for LDAP	password
PASSWORDCOCKPIT_LDAP_BASEDN	Base DN	cn=users,dc=passwordcockpit,dc=com
PASSWORDCOCKPIT_LDAP_ACCOUNTFILTERFORMAT	Filter to retrieve accounts, it match the username	(&(memberOf=cn=group_name,cn=groups,dc=passwordcockpit,dc=com)(uid=%s))
PASSWORDCOCKPIT_LDAP_BINDREQUIRESDN	Bind if DN is required, possible values: 'true' or 'false', default value: 'false'	'true'
PASSWORDCOCKPIT_LDAP_USESTARTTLS	Whether or not the LDAP client should use TLS (aka SSLv2) encrypted transport, possible values: 'true' or 'false', default value: 'false'	'false'
PASSWORDCOCKPIT_LDAP_USESSL	Whether or not the LDAP client should use SSL encrypted transport, possible values: 'true' or 'false', default value: 'false'	'false'
PASSWORDCOCKPIT_LDAP_USER_ATTR_UNIQUE_IDENTIFIER	Configure user identifier attribute, default value: 'uid'	'uid'
PASSWORDCOCKPIT_LDAP_USER_ATTR_NAME	Configure name of user attribute, default value: 'givenname'	'givenname'
PASSWORDCOCKPIT_LDAP_USER_ATTR_SURNAME	Configure surname of user attribute, default value: 'sn'	'sn'
PASSWORDCOCKPIT_LDAP_USER_ATTR_MAIL	Configure mail's user attribute, default value: 'mail'	'mail'
PASSWORDCOCKPIT_LDAP_USER_ATTR_PHONE	Configure phone's user attribute, default value: null

Available translations

Password cockpit is translated into:

• English
• Italiano
• Français
• Deutsch

Architecture and technologies

The application itself follows the RESTful architecture.
To ease deployment into production, frontend and backend have been built and merged in a single docker image.

Frontend

The frontend is maintained on passwordcockpit/frontend. Frontend has been developed using Ember.js and Bootstrap.
The PIN password encryption is made with Stanford Javascritp Crypto Library, using AES-CCM.

Backend

The backend is maintained on passwordcockpit/backend.
The server side application logic is based on PHP Standard Recommendation (PSR) using Mezzio, Laminas Components and Doctrine.
HAL is used as a JSON specification to give a consistent and easy way to hyperlink between resources.
Login information are stored using Bcrypt.
Password entitites and files are crypted with laminas-crypt, using sha-256.
User sessions are handled with JWT tokens, encrypted with HS256.
All listed encryptions are customizable with a custom key, adding cryptographic salt to hashes to mitigate rainbow tables.
All API are documented with Swagger.

Database

Database uses mysql or mariaDB

Security

To ensure the security to your Passwordcockpit instance:

• Enable SSL (https) or put the service behind a reverseproxy with SSL.
• Set your PASSWORDCOCKPIT_BLOCK_CIPHER_KEY and PASSWORDCOCKPIT_AUTHENTICATION_SECRET_KEY.
• Set your PASSWORDCOCKPIT_ADMIN_PASSWORD.
• Disable Swagger.
  
  The container runs as www-data user (non-root).

Update to a newer version

Updating is done by pulling the new image, throwing away the old container and starting the new one. Before performing an update, it is best to back up the database and persistent files. This will ensure that you have a copy of your data in case something goes wrong during the update process.

Vulnerabilities

If you find any vulnerability within the project, you are welcome to drop us a private message to: [email protected]. Thanks!

Contribute

Here you can find the steps to prepare the development environment.

Screenshots

Passwords manager

Users manager

Mobile design

passwordcockpit's Issues

Update EmberJS libraries

An error appears when editing a password with a space character

"Cannot assign Laminas\Db\Sql\Ddl\Column\Datetime to property Password\Api\V1\Entity\Password::$lastModificationDate of type ?DateTime"

Mime type error when try upload files

Hello!
I installed the docker version of this application, everything is fine except of the file upload, when I try to attach any type of file to the password entry they get Mime type error message. I tried to modify the .htaccess file and added the requested types but does not impacted to the behaviour. Please help were I'm doing wrong.

Thanks a lot,
BR
Megyo

When changing a password id from the URL, the details of the searched password are shown, but the folder structure is the same as before

Bug in searching when password and username are not set

Endpoint /passwords?q=searchField.

It returns 500 internal server error when searching a word that appears in a saved element which has no password or username.

in the password details, if the username is empty, the button to copy it remains visible (same for the URL), while the password's one does not.

docker return 500 after successful login

Hi, after successful login in self-hosted app in docker I get error on every endpoint.

{"title":"Internal Server Error","type":"https://httpstatus.es/500","status":500,"detail":"An unknown error occurred."}

On local docker it's working good, but on server not. In logs I don't have any useful information, even after set dosplay_errors "On" in php.ini.

[16/Mar/2023:11:34:50 +0000] "GET /api/v1/users/1/permissions HTTP/1.1" 500 506 "http://<hostname>/login" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36"

PASSWORDCOCKPIT_SSL is disable,
PASSWORDCOCKPIT_DEBUG is true,
PASSWORDCOCKPIT_AUTHENTICATION_TYPE is password,
PASSWORDCOCKPIT_BLOCK_CIPHER_KEY is supersecretkey,
PASSWORDCOCKPIT_AUTHENTICATION_SECRET_KEY is authenticationsecretkey.

I don't know where to search next...

Problems in the view of access rights to a folder

Elements are overlapped when the screen is small

Changing the name and surname of your profile also updates the button in the header in real time and does not get blocked at the maximum length indicated

Update library ember-cli-tinymce

Some translations related to error messages of input fields are missing

Causes Swagger to append "http://" or "https://" to a base URL that already contains the network protocol

passwordcockpit/docker/php7.3/apache/entrypoint.sh

Line 120 in 3635b37

sed -ri -e 's!PASSWORDCOCKPIT_BASEHOST!'${PASSWORDCOCKPIT_BASEHOST}'!g' swagger/swagger.json

Below is an example of the curl generated by Swagger when attempting to test the REST API:

curl -X GET "https://https://localhost/api/v1/folders" -H "accept: application/json"

The environment variable "PASSWORDCOCKPIT_BASEHOST" must have either "http://" or "https://" due to how its being used elsewhere in the entrypoint.sh script. However, since the variable is configured in Swagger.json and Swagger also appends a network protocol via a form selector, the network protocol ends up being included twice.

 "host": "https://localhost",
    "basePath": "/api",
    "schemes": [
        "http",
        "https"
    ]

Most likely need a separate environment variable for just the FQDN or IP address.

Missing escape on password description field in read

Open the related folder of the selected password after search

Allows change the language

Add a select to the right of the name that allows you to change the language.
You probably need to add an endpoint that allows you to change only the language and not all user data.
This feature can remain enabled even if LDAP is disabled.

update to PHP 8.0 or PHP 8.1

Edit password doesn't work

Update Mezzio libraries

Il logs (user management) add the name of the password when password deleted in action

Eg: Password 496 (name of the password) deleted

Button copy password not work with password with PIN

When creating an user with LDAP disable password

When creating an user with LDAP enabled the password must be disabled, so it must allow NULL.
Check also that at login if password = null you should NOT be able to login (This is to prevent you from accidentally disabling LDAP everyone can login)

LDAP Start TLS

Is there a hidden option to enable LDAP Start TLS?
If yes could you add it to the docs?

In the password generation options, selecting "special characters" also includes the number 5

Replace Zend\Authentication\Adapter\AdapterInterface::class with Laminas in entrypoint.sh

Calculate integrity in JS and CSS links of index.html on ember build #30

ember build -p
without
SRI: { enabled: false, },

in ember-cli-build.js calculates an integrity check for js and css files that are linked in index.html.
This doesn't allow you to change the js and css code after the build, so you can't change the host in the container.

To put back the functionality find the way to calculate and add the integrity with the entrypoint

This was done to create the image in docker.

Specifications: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

changing passwords in docker-compose.yml not working -- security threat

Hi folks,

it is not possible to change the following username and/or passwords in docker-compose.yml for
image: passwordcockpit/passwordcockpit:1.2.2-php-7.3-apache

Changing one of the following will result in connection errors:

•         PASSWORDCOCKPIT_DATABASE_USERNAME: passwordcockpit_db_usr
  

•         PASSWORDCOCKPIT_DATABASE_PASSWORD: password
  

  • MYSQL_ROOT_PASSWORD=root_password

•         - MYSQL_USER=passwordcockpit_db_usr
  

•         - MYSQL_PASSWORD=password
  

Suggestion:
If they are not intended to get changed by Sys-Admin, than there should be a comment or variables should be removed (or commented) from docker-compose.yml and some info in documentation is appreciated.

Thank you and kind regards!
Raphael

Error while processing route: login Maximum call stack size exceeded

An error appears in the console when the user is logged and he navigates to login page

The selection of the number of characters in the password generation options has no upper limit, with very high numbers the application crashes

LDAP Connection

Hi,

I can't connect users when ldap backend is configured, all I've got is the red pop-up (Error, Wrong username or password).
These are the parameters that I added to docker-compose.yml :
PASSWORDCOCKPIT_AUTHENTICATION_TYPE: ldap PASSWORDCOCKPIT_LDAP_HOST: ip.address.of.dc PASSWORDCOCKPIT_LDAP_PORT: 389 PASSWORDCOCKPIT_LDAP_USERNAME: uid-name,CN=user,OU=OU,DC=domain,DC=com PASSWORDCOCKPIT_LDAP_PASSWORD: my_password PASSWORDCOCKPIT_LDAP_BASEDN: OU=OU,DC=domain,DC=com PASSWORDCOCKPIT_LDAP_ACCOUNTFILTERFORMAT: (&(memberOf=CN=group,OU=OU,DC=domain,DC=com)(uid=%s)) PASSWORDCOCKPIT_LDAP_BINDREQUIRESDN: 'false' (I tested both without luck)
Do you have any hint to help me configure ldap connection?

Does the default admin work if ldap is configured? Which user is the admin?

Thank you in advance.
Mathieu

Cannot add new passwords

The button to add new password doesn't show even if I have full privileges

Add folder name in logs in user management

Add a column before "Password's title" of the password named "Folder name".
Add the name of the folder.

Add an icon to open a link in password detail / url

If you delete a folder, the application remains in that location anyway and reloading the page it crashes

PASSWORDCOCKPIT_BASEHOST does not take in Context Root?

Hi this may not be an issue, but I am just checking if there is a way to have a context root to the site, e.g. http://localhost/passwordcockpit

Password becomes visible when clicking "copy to clipboard"

Description:
Password gets visible when clicking "copy to clipboard".
This is not how it should be.

Possible reason:
When clicking the "copy to clipboard" Button, Google Chrome automatically selects the illegible password and so the password does become visible.

Expected result:
Password still not visible on "copy to clipbloard". It should be possible to copy a password to clipboard without making it visible on the screen.

This happens in Midori,Firefox and Chrome...

Needs fix.
Thank you.

When PASSWORDCOCKPIT_SSL: disabled work only with localhost or 127.0.0.1

Solution:
when PASSWORDCOCKPIT_SSL: disabled, the entrypoint have to add in config/autoload/authentication.local.php the IP like relaxed, e.g.
'relaxed' => ['10.0.0.1']

and modify JwtAuthenticationFactory to read the parameter 'relaxed'

Error messages are not translated

To reproduce:

• disable LDAP
• create a new user without password
• An error appears in the popup not translated

After deleting a user from a folder's "rights on folder" list, the modal window remains visible, obscuring the entire screen and forcing the user to refresh the page.

The enter button does not submit when creating folders.

When you click "+" to create a new folder make the enter button do the same as "Add".

If a folder already has all the users assigned to it, trying to add another one will find the select empty, but clicking on "add" will block the app

Redirect exception to the standard error output

e.g.:

$stdout = fopen('php://stderr', 'w');
fwrite($stdout, $logText);

Add the stacktrace too. If it's to long create an application.log

Development mode

Add an attribute in docker-compose.yml to active the development mode.

Simply in config/autoload/mezzio.global.php change 'debug' => false, to 'debug' => true,

Add the list of accessible folders in user management

Add a box after logs with the list of accessible folders.
Display a table with 2 columns: the name of the folder and the access rights (read or edit)

develop Installation as described in README results in "Token not found" 401

Error Message received after Installation:
{"status":401,"title":"Unauthorized","type":"https://httpstatuses.com/401","detail":"Token not found."}

Precedure used as described in README @ URL https://github.com/passwordcockpit/passwordcockpit/tree/master/develop:
cd frontend
git checkout origin master
cd ..
cd backend
git checkout origin master
docker-compose restart passwordcockpit_frontend

Further: in README its written => "After that, go to [YOUR-IP]:4200. If everything went correctly, there should be a login page."
Shouldn't that be => "After that, go to [YOUR-IP]:4344. If everything went correctly, there should be a login page." ? My fault so striked through.

Some people may change this Port to 443 standard https port.
But anyhow its not working.

Kind regards.

Use getEnv for config php

Replace creation of config/autoload/ local files with list file with list with getEnv

Nested folder not automatically expanding when creating.

When creating a new folder inside of an existing folder, the latter should automatically expand in order to show the newly created folder.

The user's login is invalidated if he changes pages after saving the language change for his profile.

No user name and password combination is recognized

I installed passwordcockpit following the instruction on a LXC in a Proxmox hypervisor. However, neither "admin" "Admin123!" and "user" "User123!" grant me access to the service. Any combination of username and password will return the same "undifined error". Would anyone know what cause the problem?

Change font of the password field to improve readability

Use Google Docs Consolas

Missing translation "Minimum length: " for locale "de"

It seems that this problem appears with all languages when inserting a single character in the title field when creating a new password