Agile Solutions' 1Password utility is a great way to generate & store secure passwords, notes, license keys and more. They even have an iPhone/iPod Touch app which makes it very easy to have access to your passwords from almost anywhere.

If you do not have an iPhone or an iPod Touch you can still access your secure seekrits on other systems via a new feature in their latest release (version 3) called iPasswordAnywhere. In a recent blog post, David Chartier — Chief Media Producer at Agile Solutions — explains how to use Dropbox to take advantage of this feature which will allow you to keep your data in sync across multiple systems (i.e. anywhere you have Dropbox installed). Dropbox syncs your encrypted 1Password database/keychain files to your linked systems and you end up accessing the contents via a fairly clever local web page (1Password.html which is located on your home system in your ~/Library/Application Support/1Password/1Password.agilekeychain directory).

While I absolutely love Dropbox, my 1Password keychain database is over 2 MB and I do not want to eat up even that little of my free space there (I do not yet have a paid account with them). I also do not necessarily need the data stored locally on each system I might be using. Despite the fact that I haven an iPhone and make regular use of the 1Password Touch app for it, I thought it would be useful to synchronize the 1PasswordAnywhere data to a web host where I could access from any host, not just ones with Dropbox on it, and also access it when I forget my iPhone or it runs out of juice.

So, if you use 1Password but do not use Dropbox, do not have an iPhone and have the ability to rsync files to a web host under your control, then read on to see what I've cooked up.

The Gory Details

To get your 1Password keychain out on the web, you will need a web host that you can rsync files to and access securely — i.e. via an SSL/TLS (https) connection. If you cannot access your web content securely, you do not want to use 1PasswordAnywhere this way as all your seekrits will be in the clear. (Warning #1)

If your web site is "https://www.example.com/", I suggest making a directory under it that you will remember but is not related to the name "1Password". While I will be using "1p" in the forthcoming examples, I would not recommend using that in your production environment. (Warning #2)

After making that directory, you will need to download & edit or re-create the following plist file and corresponding shell script. The plist file will be placed in ~/Library/LaunchAgents which will enable the shell script to be launched by the launchd daemon in OS X.

File: net.rudis.1PasswordRsyncLaunchd.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>Debug</key>
        <false/>
        <key>Label</key>
        <string>net.rudis.1PasswordRsyncLaunchd</string>
        <key>ProgramArguments</key>
        <array>
                <string>/PATH/TO/1prsync.sh</string>
        </array>
        <key>RunAtLoad</key>
        <true/>
        <key>ServiceDescription</key>
        <string>Synchronize 1PasswordAnywhere data to remote host</string>
        <key>WatchPaths</key>
        <array>
                <string>/Users/USERNAME/Library/Application Support/1Password/1Password.agilekeychain/data/default/contents.js</string>
                <string>/Users/USERNAME/Library/Application Support/1Password/1Password.agilekeychain/data/default/encryptionKeys.js</string>
                <string>/Users/USERNAME/Library/Application Support/1Password/1Password.agilekeychain/data/default/1password.keys</string>
        </array>
</dict>
</plist>

To make this plist work in your environment, you will need to change USERNAME to your OS X username (the "short" one) and /PATH/TO/1prsync.sh to wherever you store and name 1prsync.sh. This configuration file tells launchd to run 1prsync.sh at login time (or whenever launchd reloads the configuration file and also has launchd watch for changes to any of three files associated with the 1Password keychain. When a change occurs, it will sync the data.

File: 1prsync.sh (you'll need to remove the ".txt")

#!/bin/bash
#
# 1prsync.sh - sync 1PasswordAnywhere data to remote web host
#
#  Author: bob@rudis.net (a.k.a. hrbrmstr) http://twitter.com/hrbrmstr
# Version: 1.0
#    Date: 2009-11-20
#

# Local path to Growl command line utilities
GROWL_PATH=/usr/local/bin

# Local path to rsync binary
RSYNC_PATH=/usr/bin

# Remote connection information
REMOTE_USER=someone
REMOTE_HOST=somewhere.example.com
REMOTE_PATH=/path/to/1p

# Local full path to 1Password application
ONE_PASSWORD_APP=/Applications/1Password.app

# Local full path to 1PasswordAnywhere agilekeychain directory
ONE_PASSWORD_KEYCHAIN=$HOME/Library/Application\ Support/1Password/1Password.agilekeychain

# Only run if we even have the 1PasswordAnywhere data

if [ -f "$ONE_PASSWORD_KEYCHAIN/1Password.html" ] ; then

    # If the Growl command line utility exists, let the user know what is going on

    if [ -f $GROWL_PATH/growlnotify ] ; then
        $GROWL_PATH/growlnotify --message "1PasswordAnywhere Sync Started" \
                                --title "1PasswordAnywhere" \
                                --iconpath $ONE_PASSWORD_APP
    fi

    # Synchronize the data to the remote web host
    $RSYNC_PATH/rsync --quiet --recursive --links \
                       "$ONE_PASSWORD_KEYCHAIN/" \
                       $REMOTE_USER@$REMOTE_HOST:$REMOTE_PATH

    if [ -f $GROWL_PATH/growlnotify ] ; then
        $GROWL_PATH/growlnotify -m "1PasswordAnywhere Sync Finished" \
                                -t "1PasswordAnywhere" \
                                -I $ONE_PASSWORD_APP
    fi

fi

You will, at the very least, need to modify everything that starts with REMOTE_ to match your web host configuration. You will also need to ensure you can rsync without needing to enter a password. Lastly, you will need to save this to where you said you would in the plist above (remember /PATH/TO/1prsync.sh?). I recommend creating (if it does not already exist) a ~/bin and putting it in there. It will also need to be executable by launchd (chmod 500 /PATH/TO/1prsync.sh should do the trick).

Almost There

If you did use ~/bin as the path to where you stored 1prsync.sh then you can do a quick test by just executing:

~/bin/1prsync.sh

at a Terminal prompt. If you have growlnotify installed, then you will see the notifications popup and you should see the 1PasswordAnywhere files in your remote web host directory.

To get the script working as a launchd agent, make sure you put net.rudis.1PasswordRsyncLaunchd.plist in ~/Library/LaunchAgents and execute the following command at a Terminal prompt:

launchctl load -w ~/Library/LaunchAgents/net.rudis.1PasswordRsyncLaunchd.plist

To verify it loaded properly, also execute:

launchctl list | grep Rsync

and verify that it returns a line containing the name of the plist file.

You can test it by opening up 1Password and adding a secure note or deleting a credential you no longer need. When 1Password modifies one of the watched files (contents.js usually triggers it) the sync should begin. You can then browse to https://www.example.com/1p/1Password.html to verify that everything worked as expected.

While 1PasswordAnywhere requires a password to access & decrypt your seekrits, I would enable authentication for accessing the 1p directory (you *did* change that to something else, right?). (Warning #3)

Final Warning

By implementing this configuration, you are putting your seekrits out into the evil internets and if you do not secure them properly, you stand to lose a great deal. You should absolutely not do this on a shared system and you should even be wary with a virtually hosted site where you have "full control". Use this technique at your own risk!

If, however, you do accept the risks and take this for a spin, drop a note in the comments with how you fared and especially if you find any glaring errors or have suggestions for improvement.