diff options
| -rw-r--r-- | .gitignore | 10 | ||||
| -rw-r--r-- | README.md | 113 | ||||
| -rw-r--r-- | main.swift | 297 |
3 files changed, 420 insertions, 0 deletions
diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..015eedd --- /dev/null +++ b/.gitignore @@ -0,0 +1,10 @@ +# Compiled binary +keychain-fingerprint + +# macOS +.DS_Store + +# Xcode +*.xcodeproj +*.xcworkspace +DerivedData/ diff --git a/README.md b/README.md new file mode 100644 index 0000000..96ffdab --- /dev/null +++ b/README.md @@ -0,0 +1,113 @@ +# keychain-fingerprint + +Touch ID 인증으로 macOS Keychain 비밀번호에 안전하고 편리하게 접근하는 CLI 도구 + +## Why? + +macOS Keychain에 저장된 비밀번호에 접근할 때 두 가지 불편함이 있습니다: + +### 문제 1: 보안 vs 편의성 딜레마 + +`security find-generic-password` 명령어로 비밀번호에 접근하면: + +``` +"security"가 키체인의 "myapp"에 저장된 기밀 정보를 사용하려고 합니다. +[거부] [허용] [항상 허용] +``` + +- **"허용"**: 매번 Mac 비밀번호를 입력해야 함 → 번거로움 +- **"항상 허용"**: 이후 어떤 앱에서든 비밀번호 없이 접근 가능 → 보안 취약 + +### 문제 2: 비밀번호 입력의 불편함 + +Mac 비밀번호는 보통 길고 복잡해서 매번 입력하기 번거롭습니다. + +### 해결책: Touch ID + +이 도구는 **Touch ID**로 인증하여: +- **빠르고 편리함**: 손가락 한 번으로 인증 (비밀번호 입력 불필요) +- **보안 유지**: 다른 앱에서 접근 시 여전히 Mac 비밀번호 필요 + +## Installation + +```bash +# Clone +git clone https://github.com/dss99911/keychain-fingerprint.git +cd keychain-fingerprint + +# Compile +swiftc -o keychain-fingerprint main.swift -framework LocalAuthentication -framework Security + +# Install (optional) +sudo cp keychain-fingerprint /usr/local/bin/ +``` + +## Usage + +```bash +# Save password (Touch ID → secure input) +keychain-fingerprint set myapp user@example.com + +# Get password (Touch ID → stdout) +keychain-fingerprint get myapp user@example.com + +# List saved items (Touch ID) +keychain-fingerprint list + +# Delete password (Touch ID) +keychain-fingerprint delete myapp user@example.com +``` + +### Shell Variable (Recommended) + +```bash +# Capture password in variable (not displayed on screen) +PASSWORD=$(keychain-fingerprint get myapp user@example.com) + +# Use the password +echo "Using password..." + +# Clear the variable when done +unset PASSWORD +``` + +## Security + +| Access Method | Authentication Required | +|---------------|------------------------| +| This app | Touch ID | +| Other apps / `security` command | Mac password | + +### How it works + +``` +┌─────────────────────────────────────────┐ +│ keychain-fingerprint │ +├─────────────────────────────────────────┤ +│ 1. Touch ID authentication │ +│ 2. Access Keychain (auto-authorized) │ +└─────────────────────────────────────────┘ + +┌─────────────────────────────────────────┐ +│ Other apps / terminal │ +├─────────────────────────────────────────┤ +│ Keychain access → Mac password prompt │ +└─────────────────────────────────────────┘ +``` + +### Features + +- All commands require Touch ID +- Passwords stored encrypted in macOS Keychain +- Password input is hidden (no echo) +- Passwords only output to stdout (for variable capture) +- Device-only access (`kSecAttrAccessibleWhenUnlockedThisDeviceOnly`) + +## Requirements + +- macOS with Touch ID +- Xcode Command Line Tools (`xcode-select --install`) + +## License + +MIT diff --git a/main.swift b/main.swift new file mode 100644 index 0000000..d829bad --- /dev/null +++ b/main.swift @@ -0,0 +1,297 @@ +import Foundation +import LocalAuthentication +import Security + +// MARK: - Touch ID Authentication + +func authenticateWithTouchID(reason: String) -> Bool { + let context = LAContext() + var error: NSError? + + // Check if Touch ID is available + guard context.canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, error: &error) else { + if let error = error { + fputs("Touch ID not available: \(error.localizedDescription)\n", stderr) + } + return false + } + + let semaphore = DispatchSemaphore(value: 0) + var success = false + + context.evaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, localizedReason: reason) { result, authError in + success = result + if let authError = authError { + fputs("Authentication failed: \(authError.localizedDescription)\n", stderr) + } + semaphore.signal() + } + + semaphore.wait() + return success +} + +// MARK: - Keychain Operations + +func getKeychainPassword(service: String, account: String) -> String? { + let query: [String: Any] = [ + kSecClass as String: kSecClassGenericPassword, + kSecAttrService as String: service, + kSecAttrAccount as String: account, + kSecReturnData as String: true, + kSecMatchLimit as String: kSecMatchLimitOne + ] + + var result: AnyObject? + let status = SecItemCopyMatching(query as CFDictionary, &result) + + if status == errSecSuccess, let data = result as? Data { + return String(data: data, encoding: .utf8) + } else if status == errSecItemNotFound { + fputs("Error: Password not found\n", stderr) + } else if status == errSecAuthFailed { + fputs("Error: Authentication failed\n", stderr) + } else { + fputs("Error: Keychain error (status: \(status))\n", stderr) + } + + return nil +} + +func setKeychainPassword(service: String, account: String, password: String) -> Bool { + // First, try to delete existing item + let deleteQuery: [String: Any] = [ + kSecClass as String: kSecClassGenericPassword, + kSecAttrService as String: service, + kSecAttrAccount as String: account + ] + SecItemDelete(deleteQuery as CFDictionary) + + // Add new item (without Access Control - requires paid Developer Program) + // Security is provided at app level via Touch ID authentication + guard let passwordData = password.data(using: .utf8) else { + fputs("Error: Failed to encode password\n", stderr) + return false + } + + let addQuery: [String: Any] = [ + kSecClass as String: kSecClassGenericPassword, + kSecAttrService as String: service, + kSecAttrAccount as String: account, + kSecValueData as String: passwordData, + kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly + ] + + let status = SecItemAdd(addQuery as CFDictionary, nil) + + if status != errSecSuccess { + fputs("Error: Failed to save password (status: \(status))\n", stderr) + return false + } + + return true +} + +func deleteKeychainPassword(service: String, account: String) -> Bool { + let query: [String: Any] = [ + kSecClass as String: kSecClassGenericPassword, + kSecAttrService as String: service, + kSecAttrAccount as String: account + ] + + let status = SecItemDelete(query as CFDictionary) + + if status == errSecSuccess || status == errSecItemNotFound { + return true + } + + fputs("Error: Failed to delete password (status: \(status))\n", stderr) + return false +} + +func listKeychainItems(service: String? = nil) -> [(service: String, account: String)] { + var query: [String: Any] = [ + kSecClass as String: kSecClassGenericPassword, + kSecReturnAttributes as String: true, + kSecMatchLimit as String: kSecMatchLimitAll + ] + + if let service = service { + query[kSecAttrService as String] = service + } + + var result: AnyObject? + let status = SecItemCopyMatching(query as CFDictionary, &result) + + var items: [(service: String, account: String)] = [] + + if status == errSecSuccess, let itemList = result as? [[String: Any]] { + for item in itemList { + if let service = item[kSecAttrService as String] as? String, + let account = item[kSecAttrAccount as String] as? String { + items.append((service: service, account: account)) + } + } + } + + return items +} + +// MARK: - Secure Input + +func readSecurePassword() -> String? { + // Disable echo for secure input + var oldTermios = termios() + tcgetattr(FileHandle.standardInput.fileDescriptor, &oldTermios) + + var newTermios = oldTermios + newTermios.c_lflag &= ~UInt(ECHO) + tcsetattr(FileHandle.standardInput.fileDescriptor, TCSANOW, &newTermios) + + defer { + // Restore echo + tcsetattr(FileHandle.standardInput.fileDescriptor, TCSANOW, &oldTermios) + print("") // New line after hidden input + } + + return readLine() +} + +// MARK: - Main + +func printUsage() { + fputs(""" + Usage: keychain-fingerprint <command> [options] + + Commands: + get <service> <account> Get password (requires Touch ID) + set <service> <account> Set password (requires Touch ID) + delete <service> <account> Delete password (requires Touch ID) + list [service] List items (requires Touch ID) + + Security: + - All commands require Touch ID authentication + - Passwords stored in macOS Keychain (encrypted) + - Password input is hidden (no echo) + - Other apps require Mac password to access + + Examples: + keychain-fingerprint get myapp user@example.com + keychain-fingerprint set myapp user@example.com + keychain-fingerprint list + keychain-fingerprint delete myapp user@example.com + + Shell variable usage: + PASSWORD=$(keychain-fingerprint get myapp user@example.com) + # use $PASSWORD + unset PASSWORD + """, stderr) +} + +func main() { + let args = CommandLine.arguments + + guard args.count >= 2 else { + printUsage() + exit(1) + } + + let command = args[1] + + switch command { + case "get": + guard args.count >= 4 else { + fputs("Error: 'get' requires <service> and <account>\n", stderr) + exit(1) + } + + let service = args[2] + let account = args[3] + + // Touch ID authentication + guard authenticateWithTouchID(reason: "Keychain 비밀번호 조회를 위해 인증이 필요합니다") else { + exit(1) + } + + if let password = getKeychainPassword(service: service, account: account) { + print(password) + } else { + exit(1) + } + + case "set": + guard args.count >= 4 else { + fputs("Error: 'set' requires <service> and <account>\n", stderr) + exit(1) + } + + let service = args[2] + let account = args[3] + + // Touch ID authentication first + guard authenticateWithTouchID(reason: "Keychain 비밀번호 저장을 위해 인증이 필요합니다") else { + exit(1) + } + + fputs("Enter password: ", stderr) + guard let password = readSecurePassword(), !password.isEmpty else { + fputs("Error: No password provided\n", stderr) + exit(1) + } + + if setKeychainPassword(service: service, account: account, password: password) { + fputs("Password saved successfully\n", stderr) + } else { + exit(1) + } + + case "delete": + guard args.count >= 4 else { + fputs("Error: 'delete' requires <service> and <account>\n", stderr) + exit(1) + } + + let service = args[2] + let account = args[3] + + // Touch ID authentication + guard authenticateWithTouchID(reason: "Keychain 비밀번호 삭제를 위해 인증이 필요합니다") else { + exit(1) + } + + if deleteKeychainPassword(service: service, account: account) { + fputs("Password deleted successfully\n", stderr) + } else { + exit(1) + } + + case "list": + // Touch ID authentication + guard authenticateWithTouchID(reason: "Keychain 목록 조회를 위해 인증이 필요합니다") else { + exit(1) + } + + let service = args.count >= 3 ? args[2] : nil + let items = listKeychainItems(service: service) + + if items.isEmpty { + fputs("No items found\n", stderr) + } else { + fputs("Service\t\t\tAccount\n", stderr) + fputs("-------\t\t\t-------\n", stderr) + for item in items { + fputs("\(item.service)\t\t\(item.account)\n", stderr) + } + } + + case "help", "-h", "--help": + printUsage() + + default: + fputs("Unknown command: \(command)\n", stderr) + printUsage() + exit(1) + } +} + +main() |