Mutt: how to safely store password?

To store your imap password safely in GNOME Keyring

put

source ~/.muttrc-retrieve_password |

in your .muttrc with .muttrc-retrieve_password like

IMAP_PASS=$(secret-tool lookup user john_doe host mail.example)
echo "set imap_pass='$IMAP_PASS'"

where you need secret-tool to be installed via

$ apt-get install libsecret-tools -y

and the corresponding entry created like

$ secret-tool store --label=mutt user john_doe host mail.example service imap

at least for mutt 1.9.4 @ ubuntu bionic.

---

Update: Instead of source you may directly put the line

set imap_pass=`secret-tool lookup --label=mutt user john_doe host mail.example`

into .muttrc (mark the backticks!)

You can read the password from an unencrypted file.

For example, put the password into ~/secrets/mail_pass:

the_secret_mail_password

Then

chmod 600 ~/secrets/mail_pass

In your muttrc:

# Read the password from a file and set it
set smtp_pass=`cat ~/secrets/mail_pass`

Why not use a wallet manager like gnome-keyring or kwalletmanager with secret-tool?

apt install gnome-keyring secret-tool

.[neo]muttrc:

source 'echo "$( pw=$( secret-tool lookup user <USERNAME> domain <DOMAIN> ); echo set imap_pass="$pw"; echo set smtp_pass="$pw" )" |'

Store your imap and smtp passwd:

secret-tool store --label=imap user <USERNAME> domain <DOMAIN>

You could choose your own label if you wanted to.

Look up your creds using a shell:

secret-tool lookup user <USERNAME> domain <DOMAIN>

Fire up your [neo]mutt, connect & login to your imap srv. Enjoy.

This solution has advantages over gpg-based ones: it integrates well and there's no additional file left layin' around.

Bonus: Use libsecret or directly gnome-keyring as a git credential-helper as in git with libsecret and git with gnome-keyring. Both helpers need manual compilation. Yes, it's a bit awkward but it is working great.

Based on ShreevatsaR's comment, I want to emphasize security. If password in $HOME/.muttrc, do

chmod go-r $HOME/.muttrc

However, I think this is not a secure option still. You should use some method which uses salt in storing passwords.

Create a passwords file: ~/.mutt/passwords:

set imap_pass="password"
set smtp_pass="password"

This file can be encrypted using GPG. First, create a public/private key pair:

$ gpg --gen-key

Encrypt the passwords file:

$ gpg -r [email protected] -e ~/.mutt/passwords
$ ls ~/.mutt/passwords*
/home/user/.mutt/passwords   /home/user/.mutt/passwords.gpg
$ shred ~/.mutt/passwords
$ rm ~/.mutt/passwords

Add to your muttrc:

source "gpg -d ~/.mutt/passwords.gpg |"

via

See also Arch Wiki's Mutt entry.

This tweak should get rid of your problem. Use gpg as suggested, or

set imap_pass=`getpassword email_id`

where you use pwsafe or passwords to fetch the passwords.

Edit: If mutt is built with IMAP support (--enable-imap), then mutt should prompt you for the password if you do not set it in the config file. From the manual:

imap_pass

Type: string Default: ""

Specifies the password for your IMAP account. If unset, Mutt will prompt you for your password when you invoke the fetch-mail function. Warning: you should only use this option when you are on a fairly secure machine, because the superuser can read your muttrc even if you are the only one who can read the file.