granddave / aegis-rs

Aegis compatible OTP generator for the CLI

Aegis 2FA Authenticator CLI

This is a CLI tool for generating OTP codes from a backup vault from the Android app Aegis Authenticator.

Features

• Decryption of the 256 bit AES-GCM encrypted vault 🔓
• Fuzzy selection 🔍
• TOTP generation 🕒
• Time left indication ⏳
• Clipboard support 📋
• JSON output to stdout 📜

Getting Started with Aegis-rs

Installation

The easiest way to install Aegis-rs is by downloading a pre-compiled binary from the latest release.

You can also download and compile yourself by using cargo-install:

$ cargo install --git https://github.com/Granddave/aegis-rs --tag latest

Launching Aegis-rs with a Backup File

To start Aegis-rs, simply pass the path to your backup file as an argument and enter password. For example:

$ aegis-rs ~/Documents/aegis-backup-20230512-193110.json
? Insert Aegis Password › ********

Searching for an Entry

Aegis-rs supports fuzzy finding for quickly locating entries. Type a part of the entry's name to filter the list. For instance:

› tw
❯ Twitter (@johndoe)
  Twitch (johndoe)
  TeamViewer ([email protected])
  Bitwarden ([email protected])

Generating an OTP

Aegis-rs allows you to read the OTP directly in the terminal or paste it using the integrated clipboard support. OTPs are regenerated automatically upon expiration. Here the OTP is displayed, including its remaining validity:

· Twitter (@johndoe)
121921 (28s left)

Ways to unlock the Vault

To unlock the Aegis vault Aegis-rs supports the following methods:

1. Password: The password can be passed as an argument or set as an environment variable.
   • Environment variable: AEGIS_PASSWORD
   • Argument: --password <PASSWORD>
   • Example: aegis-rs --password hunter2 vault.json
2. Password file: A file containing the password to unlock the vault.
   • Environment variable: AEGIS_PASSWORD_FILE
   • Argument: --password-file <PASSWORD_FILE>
   • Example: aegis-rs --password-file /path/to/password-file vault.json
3. Password prompt: If no password is provided, Aegis-rs will prompt you to enter the password.

Extra flags

• --issuer <ISSUER>: Filter entries by entry issuer.
• --name <NAME>: Filter entries by entry name.
• --json: Output the calculated OTPs as JSON.

TODO

• Add password file feature
• Add countdown timer and refresh TOTP code after timeout
• Display digits in groups
• Add TOTP to clipboard
• Add CI

Project history

This project has been divided into a binary (this repo) and a vault utility crate so that other projects can utilize the parsing and OTP generation functionalities as well.

License

This project is licensed under the GNU General Public License v3.0. See the LICENSE file for details.

aegis-rs's Issues

Support for database version 3

When I try to run aegis-rs with a new export or backup, I get the following error message:

Error:
0: Unsupported database version: 3

Location:
src/vault.rs:53

Crate bytemuck 1.16.1 is yanked

Switch to a different version of bytemuck to resolve this issue.

Wishlist - add key to go back from OTP to list

Hello,
thanks for this helpful program. For me it would be helpful to have the possibility to go back from displaying the OTP to the list to select a new account / token.

Current implementation (as i understand) is just a one-shot: start app -> enter password -> select one account -> exit

Here (for being lazy and not wanting to enter my password again and again but being too paranoid to store it on disc / inside env-var) it would be helpful to be able to go back from the OTP to the account list by pressing ESC / arrow left / Q or similar. Now i could select another account and display the OTP there too without having to enter my password again.

Thanks,
Stefan

Howto compile on Debian 12?

Hello, i try to install this tool on a Debian 12 system but fail on dependency resolution.

Debian bookworm (stable) provides "rustc" at version 1.63, no newer version available in updates/backports.
But it seems it is not possible to compile your app with this setup. Running "cargo install ..." as given on the Readme returns the following error:

error: failed to compile `aegis-rs v0.3.0 (https://github.com/Granddave/aegis-rs?tag=latest#5b1c7669)`, intermediate artifacts can be found at `/tmp/cargo-installnyX1PT`

Caused by:
  package `nix v0.27.1` cannot be built because it requires rustc 1.65 or newer, while the currently active rustc version is 1.63.0
  Either upgrade to rustc 1.65 or newer, or use
  cargo update -p [email protected] --precise ver
  where `ver` is the latest version of `nix` supporting rustc 1.63.0

As i am completly new to Rust i am stuck here as i have no idea on how to downgrade or check what compiler version is needed and so on...

Another question - is there some pre-compiled version available to not have the hassle with build problems due to different setups/compilers/...?

Thanks in advance for help,
S. Seide

Non-interactive mode for retrieving OTPs

hi there,

just an idea: if you would give each service in the vault a unique ID and if you could get an token with one single command like

aegis-rs ~/Documents/aegis-backup-20230512-193110.json --password=xxxxxxxxx --service=1

(1 = twitter)

there would be a chance to make a web-interface for that 😏

Unsupported database

Hi, I'm using Aegis latest version and I have exported encrypted json backup with it.

When I run aegis-rs encrypted.json and type my password after Insert Aegis Password, it says Failed to open vault: Unsupported database version: 3. I'm using Windows 10.

Is it an issue on windows only?

Application exits when it fails to interact with the clipboard

Would it be possible to make the application fall back to not using the clipboard if it fails to interact with it? I encountered the following error when pressing enter on an entry to display its code.

Error: 
   0: Unknown error while interacting with the clipboard: failed to lookup address information: Temporary failure in name resolution

Location:
   src/bin/cli.rs:71

Backtrace omitted. Run with RUST_BACKTRACE=1 environment variable to display it.
Run with RUST_BACKTRACE=full to include source snippets.

I'm using aegis-rs on NixOS, inside a fairly strict bubblewrap sandbox where there's no networking available (including unix sockets):

bwrap \
  --ro-bind /nix/store /nix/store \
  --ro-bind /path/to/vault.json /path/to/vault.json \
  --unshare-all \
  --die-with-parent \
  $(realpath $(which aegis-rs)) \
  /path/to/vault.json