RVAULT(1)

NAME
rvault - secure and authenticated store for secrets and small documents

SYNOPSIS
rvault [options] command [args]

DESCRIPTION
rvault is a secure and authenticated store for secrets (passwords, keys, certificates) and small documents. It uses envelope encryption with one-time password (OTP) authentication. The vault can be operated as a file system in userspace.

OPTIONS
The general options are:

-c | - -ciphers
    List the available ciphers.

-d | - -datapath path
    Base path to the vault data.

-h | - -help
    Show the application help text.

-l | - -log-level level
    Set the log level: DEBUG, INFO, WARNING, ERROR, CRITICAL.

    The levels are case insensitive.

-s, - -server url
    Authentication server address.

-v, - -version
    Print version information and quit.

COMMANDS
The first argument, command, specifies the action to take. Available commands are:

create [-c cipher] [-m mac] [-n] [-h] uid
    Create a new vault with the given UID.
    -c | - -cipher cipher
        Cipher to be used for encryption.
    -m | - -mac mac
        MAC algorithm to use for composite AE scheme.
    -n | - -noauth
        No authentication. WARNING: Such use case is very significantly less secure.
    -h  Show help of this command.

export-key
    Print the metadata and the effective encryption key. This command can be used to backup the key and relevant metadata for recovery purposes. WARNING: Leaking this key would compromise the data, therefore expose it with caution.

    This data can later be typed into a file and vault recovered using the mount command with the -r flag. The recovery data must be typed back exactly as it was printed.

ls [-a] [-h] [path]
    List the vault contents.
    -a | - -all
        Show all files and directories, including the files beginning with dot.
    -h  Show help of this command.

sdb Enter the command line interface (CLI) to operate the database of secrets (e.g. passwords). The following inner commands are available within the CLI:

    LS  List secrets.

    GET name
        Get the secret value.

    SET name
        Set the secret value.

    DEL name
        Delete the secret.

    The given names must not have white spaces. The secret will be asked in a prompt.

mount [-c 1|0] [-d] [-f] [-r path] [-s mode] [-h] path
    Mount the vault as a FUSE file system at the given path.
    -c | - -compress 1|0
        Enable or disable (default) compression.
    -d | - -debug
        Enable FUSE-level debug logging.
    -f | - -foreground
        Run in the foreground, i.e. do not daemonize.
    -r | - -recover path
        Mount the vault using the recovery file.
    -s | - -sync mode
        Sync mode on write operations: weak (faster, but less durable/safe) or full (default).
    -h  Show help of this command.

read path
    Read and decrypt the file in the vault.

write path
    Encrypt and write the file into the vault

All paths for these commands must represent the namespace of vault.

DATA AUTHENTICATION
Authenticated encryption (AE) is used for the file data and metadata, including the file and directory names.

The file system tree as a whole, however, is not authenticated. This is something to be aware of if the encrypted data would be stored externally (e.g. as a backup). Future versions of rvault might provide a solution for this with snapshot or backup functionality.

ENVIRONMENT VARIABLES
The following environment variables are available:

RVAULT_PATH
    Base path of the vault data.

RVAULT_SERVER
    Authentication server address.

FILES
The following files reside in the directory specified by RVAULT_PATH:

rvault.error_log
    error log (use for troubleshooting)
rvault.metadata
    vault information/metadata file
rvault.sdb
    secret database (used by the sdb command)
rvault.pid
    PID of the rvault FUSE daemon

EXAMPLES
An example how to initialize and mount a new vault:

    export RVAULT_SERVER=...
    export RVAULT_PATH=/home/user/vault
    rvault create $UID
    rvault mount /mnt/vault

SEE ALSO
rvault project on Github: https://github.com/rmind/rvault

AUTHORS
Mindaugas Rasiukevicius <rmind@noxt.eu>