Password manager specifically KeepassDX - sync

Bismark

Any suggestions on how to sync the password database from KeePassDX (Android) KeepassXC (Linux)?
I have a very secure server, and just tired of manually copying and pasting to various devices when I update the keepass database.
Is DAVx the way to go? Maybe nextcloud sync? What do you guys do regarding keepass? I just want something that just works. I'm thinking the way my contacts sync up with davx and nextcloud.

ralm

Bismark
I'm a believer in the original KeePass. Numerous sync options, some of which have possibilities with KeePassXC. Plugins SftpSync (Linux) or IOProtocolExt (Windows) are easy to setup and use.

Afaik, KeePass2Android is the only KeePass fork for Android with built in sync. If you're not using Play Store you can get it from Github or perhaps with its repo setup in Obtainium.

I don't recommend stashing kdbx files in Nextcloud's file system. If you must, its data directory should be a level or two away from the docroot. There may be options for opening kdbx files in Nextcloud, I'm only familiar with the KeeWeb app which was decent but hasn't been updated in years.

DeletedUser720

Bismark go syncthing

SiriusLeigh

Bismark Best solution fior me is to use Syncthing. I sync across Android, Linux and Raspberry Pi.
If you use a VPN across all three, you'll need to allow for LAN traffic passthriugh.
Keeping it within a LAN means you don't worry about passing it externally, say to Nextcloud. I used to use NC but dropped using it due to constant web maintenance issues.

kmielke

I do it with nextcloud. Works fine...

BeepBeep

I think there are security issues with Nextcloud, but perhaps you have those addressed to your satisfaction.

I use Proton Drive, but it's not a fully automatic sync (yet -- Proton is reportedly working on it). Windows syncs in the true sense of the word. Android/GOS will sync a downloaded file, but changes you make on your phone don't auto update the server copy like Windows does. And Linux is still fully manual, for now. I have a windows laptop which I make a point of using when I update KeePass. I only use Nextcloud for low security items.

DohnJoe

Since this thread has been resurrected, we can go through a couple of points

BeepBeep I think there are security issues with Nextcloud
I would like to have a source for this.

Every system might have flaws, and every piece of software increases the attack surface.
Complex (not complicated, just complex) systems like Nextcloud, which includes a lot of software, might have a larger surface available for attackers, but if the software is actively mantained, also on a security perspective, I wouldn't drop it because it might get attacked.
Also the webdav plugin of apache webserver might get attacked...

That said, I would put on the plate another solution that might interest both @BeepBeep and the OP, which is using something like cryptomator to create an e2e encrypted vault in virtually any cloud.
This will ensure the correct privacy also in the most controversial clouds, like Google Drive or the like.
Combining an "enterprise" cloud with the e2e encryption would grant both privacy and security almost for free (Cryptomator is free for Linux, paid for android).

DeletedUser713

I installed vaultwarden myself (even if I opted to not use docker), and I can say that it has its pros and cons.
Biggest cons I found, it's not very friendly to use with ssh keys.
Also, if you have to access your vault from an Enterprise network, HTTP POST method might be limited, including the possibility to upload files (like an ssh key).
Apart from this, I would say I didn't have a lot of issues.

Your cloud, especially using webdav (which is an extension of http), might be reachable also from enterprise networks, even if sometimes you should ask proxies/firewalls providers to categorize it as something different than a cloud, like a blog.

Long story short, Bitwarden/Vaultwarden might have some limitations for some niches users that other choices might not have.

johnq Being open source and self hosted does not protect you from having your passwords stolen

Completely agree.
On this regard, there are some good communities (like disroot) we could use which remove the hassle of self-hosting without changing our choices

kmielke

If you go with proton you can use proton pass.

Lion

I'd suggest syncthing.
Relatively simple to setup and works as expected.
Syncthing-fork on android can reduce battery consumption by running only at user defined intervals and only if network/charging related conditions are met.
Having an always reachable server is of course a plus, but required as syncthing works p2p.

Bismark

Lion Well I asked grok, and he said the same as you. thx

Lion

Sorry,
that was memt to be a "NOT required".
(Not able to modify my previous message any more.)

finitefutility

I used to use the official syncthing app for this, but gave up when they stopped supporting Android. Especially because I moved to filen.io so now I consider the KeepassXC copy the master copy which gets backed up into filen.io and then I use the Android app to download that copy into GrapheneOS. I don't change passwords that frequently so I find this acceptable enough.

Bismark

ralm
That is good advice on not trusting nextcloud. I myself have a bit more trust than most since mine is running on a small raspi like device using full disk encryption (dropbear, initramfs, serial ports disabled...) and its colocated in a datacenter. (I do have a tutorial on how to do this - your own cloud - 4TB and I know of 3 datacenters charging 10 USD or less a month) Also you can use fail2ban to quickly block anyone going to your domain and trying to guess url's subdomains and also web crawlers/scanners. For someone hosting on a vps I would not trust that at all. My trust in nextcloud is slightly more than most because of my setup. Thanks for your suggestions, im going to look into them.

DeletedUser720
I already use syncthing, just not on my phone, the one on fdroid is a bit crude IMO.

DeletedUser720

Bismark is it the same as https://github.com/Catfriend1/syncthing-android ?

Spasiba

Bismark

(I do have a tutorial on how to do this - your own cloud - 4TB and I know of 3 datacenters charging 10 USD or less a month)

I would be interested in that tutorial!

Bismark

DeletedUser720
Yes, it looks like it was installed on my phone but not used. I was at version 1.30 updating it now.

edit: hmm version 2.x looks like a improvement on the gui. Guess I can tinker with it today. I remember it being a bit crude before feeling like a front end on a web browser. this looks a bit more polished.

Bismark

According to Aurora Store:

The two choices:

keepassDX - 10 permissions, works without google play, no known trackers
keepass2android - (from playstore not github) 15 permissions, ? probably works without google play, 1 known tracker

--
The added permissions the keepass2android has are probably related to dropbox, some cloud service... I think using keepassDX, and then just syncing the database file is best for my scenario for my case.

Nobody

I use nextcloud for db sync. Do not see any real security issue in terms of the DB security as its AES encrypted with FIDO2. Not to mention the ARGON2-iD key function I have set to quite costly. encrypt rds 2, Mem 1073741824 bytes, parallelism 4.

It makes sync between user profiles and other devices so simple. It is too bad Android keepass ports donnot have the full function or p,ugin inventory of std desktop keepass.

If its really an issue setup your own nextcloud session.

Bismark

Nobody
I think nextcloud app wants to many permissions.
I finished setting up syncthing and it works really fast. Im very happy with that setup.
All my syncthings are set up to only listen and communicate through lan (wireguard vpn), I just need to fine tune it because I usually dont have the vpn running 24/7 on my phone and I bet I forget to turn it on to sync when I make a new entry or update something in keepasss. I'll have to google that last sentence of yours. lol

Nobody

Bismark

The only permissions I have for using next cloud app for file db sync are network, notification and scope for a single folder as I wanted one set manually for local copy initially but found with cache sync and bkup copy it was not necessary. I could literally setup next cloud app with only the network permission. Now maybe if you wantbto fully use all the comms etc features obviously it would need more. But its only use for me is DB sync. That is until Proton gets its software worked out for live sync. The free host I use right now is good cloud and has worked fine. But I will change to proton unless I can figure out the VPN issue with home network has hosting. I would never connect to any home network host without VPN regardless of my DMZ and port setups.

I want to selfhost on my nas adding a cloud app but only if I can connect thru my gateway fw VPN. I would never feel comfortable port fwd the ports need for cloud app to work directly to my NAS server even with it being BDS based. I think fw VPN software is more vetted and tested that the complex code of cloud software with its numerous comms abilities. The issue of VPN with android is you can only run one. As I use a VPN for all my std net use away from my home network its an issue then to have a live connection to my self hosted kp db file

cloudcoroner

My move from iOS years ago to grapheneos was primarily about taking back control of my data (away from cloud services). I decided to leverage what I already had at home, which was a NAS device. What I ended up with is the following, which solved your use case:

each person in my house has a user account on the NAS
the NAS is not cloud connected nor open to the internet
each user downloads a drive sync app directly from the NAS vendors website
I have my GOS phone, Tablet, Linux laptop and Mac desktop all syncing with the NAS.
I have different sync folders and sync types setup. For example, I have a folder for called PasswordDB and my kdbx file is stored there, the folder is set for two way sync and offline use (a local copy is stored on every device). KeepassX on my Mac, KeepassDX on my GOS devices, and KeePassXC on my Linux boxes all sync this same folder.
for media, I have a Pictures folder, Videos folder. Each folder has a subfolder named for each device, the folders are setup for one-way sync (device to server) and not for offline use.

This type of approach works great across device platforms and keeps you in control of your most sensitive data (password db and pictures). For other, non sensitive, data objects, you could use cloud services.

For redundancy, a replica NAS is an option, or you can setup an encrypted cloud sync with box or dropbox where you create an encryption key, and the objects on your NAS and encrypted on the device, then synced to the cloud service so the service cannot decrypt them. This is usually a paid capability due to the amount of data synced from the NAS. The benefit is you can choose which folders to perform an encrypted sync with. If your NAS is irrecoverable for some reason, you can setup a replacement, get the sync credentials and encryption key from your keepass db (which should be accessible since this architecture keeps a copy saved across your devices) to repopulate. An alternative is buy a second NAS, configure it as a mirror, perform the initial sync then move it to a friends or family members house and sync it over a VPN.

DeletedUser713

cloudcoroner For example, I have a folder for called PasswordDB and my kdbx file is stored there, the folder is set for two way sync and offline use (a local copy is stored on every device). KeepassX on my Mac, KeepassDX on my GOS devices, and KeePassXC on my Linux boxes all sync this same folder.

Just curious: why go through the hassle of syncing a db (and risking version mismatching to straight up corruption), instead of setting up a (local) Vaultwarden Docker instance? This beats Keepass by a mile in reliability, since Keepass was never designed to have its db moved around all the time.

cloudcoroner

Also, somewhat related to your question... I have also setup CalDav and CardDav services on my NAS to share contacts and calendars across devices and with family. I installed DavX5 on my GOS devices to setup this sync, on my laptops and desktops, their various apps can sync directly. (I.e. Thunderbirds calendar)

For all these use cases to work seamlessly, consider your VPN service (if you have one). You will need one that allows split tunneling.

cloudcoroner

DeletedUser713
At the time, while moving to GOS, I was trying to minimize changes since the move from iOS was big enough 😀. I was already leveraging KeePass on my desktops and using the app!e password manager. I focused on moving to keepass and leveraging my NAS. You are correct, KeePass is not meant to be multi-user, and setting up Vaultwarden on my NAS with bitwarden clients may be a better setup.

The sync has served me well so far, I have the NAS setup to version conflicts in that folder. I may look into your suggestion in the future, though, now that it has been almost four years since my GOS migration. Wow, time flies!

johnq

DeletedUser713 Just curious: why go through the hassle of syncing a db (and risking version mismatching to straight up corruption), instead of setting up a (local) Vaultwarden Docker instance? This beats Keepass by a mile in reliability, since Keepass was never designed to have its db moved around all the time.

Sorry to ressurect this, but I;'m leaving it here for others to be aware. Being open source and self hosted does not protect you from having your passwords stolen, and this has been discussed at the Bitwarden forums in the past. In short, because the vast majority of users blidnly hit "upgrade" without checking the source code changes (most aren't knowledgeable enough to begin with), someone who compromises the codebase can push out a malefic version that sends keys elsewhere as well. You could address this by restricting both the server and all clients to only accept from/send to specific IP addresses (e.g. use Tailscale on mobile clients, or port knocking, etc), but it starts getting to be of similar hassle as sync'ing keepas databases ... for which there still isn't any reliable cross-platform solution (every solution invariably leads to conflicts).

DeletedUser713

cloudcoroner I find Vaultwarden (and by proxy Bitwarden) a tad more polished, due to its more commercial nature, so I really invite you to try it out. It has served me an equally good amount of time as Keepass has for you :)