Command line Password manager

Hi all,
I've been looking around for sometime in regards to a command line
password manager. Basically the idea is to have 1 master password to
manage a lot of customised login information via the command line.

Possible scenario goes like this:

User "AAA" (in group GroupA) runs this in terminal:

% pwdmgr -L master/master_password -U user -S oracle_db01
# Returning password for user: user for service: oracle_db01
odb01password
% pwdmgr -L master/master_password -U user -S oracle_db02
Error: Insufficient privilieges to view password for user: user in
service: oracle_db02

User "PWDADMIN" (in group Admin) runs this in terminal:

% pwdmgr -L admin/admin_password -U user -S oracle_db02
# Returning password for user: user for service: oracle_db02
odb02password
% pwdmgr -L admin/admin_passowrd -U user -S oracle_db01 -G GroupA -P
odb01password
# Setting password for user: user in group: GroupA for service:
oracle_db01

The user, "AAA" (in GroupA), has read-only access to service
oracle_db01 but no access to oracle_db02. However the administrator
by
the username "PWDADMIN" (in group Admin) has the right to set
passwords and retrieve password for any service type.

It would be nice to have something like /etc/passwd and /etc/shadow
structure --- but having written a simple demo perl script ---
encryption and decryption methods must be solid as source codes can
be
viewed by those who have the write execute it.

I am not requesting that readers of this group to write me a script,
but
I am simply asking if anyone has been in this situation and has
successfully implemented or found a software which handles all this.
Or may be you guys can point me in the right direction as to how to
implement a such thing.

Thanks,
David
..

Re: Command line Password manager

"David G. Hong" writes:

> % pwdmgr -L master/master_password -U user -S oracle_db01

If "master_password" is a real password, then ps(1) will reveal the
user's master password.


>It would be nice to have something like /etc/passwd and /etc/shadow
>structure ---

But these files do not contain passwords. They contain HASHES of passwords.

The problem is - how do you get the password out of a generic utility
into another command line-based utility without exposing the password?

People may write such a utility, but if they announce it, security
experts will give them a hard time.