tentacle

README

Tentacle

Retrieve your secrets from wherever they live. Vault/Cyberark/Thycotic/Keychain/Keyring/etc.

Introduction

Tentacle provides a way to retrieve credentials from your secret manager in a standardized way. Tentacle has a CLI but can also be used as a Go library.

Tentacle was designed to be used in automation.

Features

• Single binary available for macOS and linux (windows comming soon). No external dependencies.
• Simple commandline
• Comprehensive configuration file
• Supports multiple secret managment services
• Allows aliasing multiple secret management systems (stage/prod credential storage)

Getting Started

1. Download the latest release binary from the Release pages for your OS. (Mac, Windows and Linux available)
2. Rename the downloaded binary to tentacle
3. Run chmod +x tentacle
4. Move the renamed binary into your PATH, eg. /usr/bin/local
5. Run tentacle --help from a terminal to confirm it was installed correctly
6. Add a configuration file to ~/tentacle.yaml. See Configuration section

Usage

$ tentacle help
 ____  ____  __ _  ____  __    ___  __    ____
(_  _)(  __)(  ( \(_  _)/ _\  / __)(  )  (  __)
  )(   ) _) /    /  )( /    \( (__ / (_/\ ) _)
 (__) (____)\_)__) (__)\_/\_/ \___)\____/(____)
github.com/AnalogJ/tentacle                    darwin.amd64-1.0.0

 NAME:
   tentacle - Summary retrieval made simple

USAGE:
   tentacle-darwin-amd64 [global options] command [command options] [arguments...]

VERSION:
   1.0.0

AUTHOR:
   Jason Kulatunga <jason@thesparktree.com>

COMMANDS:
     help, h        Shows a list of commands or help for one command

GLOBAL OPTIONS:
   --debug         Enable Debug mode, with extra logging (default: false)
   --output value  Specify output type. Allowed: 'json', 'yaml', 'table', 'raw' (default: "yaml")
   --help, -h      show help (default: false)
   --version, -v   print the version (default: false)

Actions

Get

List

Output formats

Configuration

Testing

Tentacle provides an extensive test-suite based on go test. You can run all the integration & unit tests with go test

CircleCI is used for continuous integration testing: https://circleci.com/gh/AnalogJ/tentacle

Contributing

If you'd like to help improve Tentacle, clone the project with Git and install dependencies by running:

$ git clone git://github.com/AnalogJ/tentacle
$ dep -ensure

Work your magic and then submit a pull request. We love pull requests!

If you find the documentation lacking, help us out and update this README.md. If you don't have the time to work on Drawbridge, but found something we should know about, please submit an issue.

Current Providers

Tentacle supports retrieving secrets via API's as well as OS specific credential storage.

Network/Cloud

1. Cyberark
2. Conjur
3. Lastpass
4. Manage Engine Password Manager Pro
5. Thycotic

OS Secret Storage

• MacOS - keychain

Future Providers

Network/Cloud

• 1Password - ⛔ no API
• Avecto Defendpoint - 💵
• AWS
• BeyondTrust PowerBroker - partner program
• Bitwarden - open source
• BomGar PAM - 💵 api docs
• Chef Encrypted Databags
• Dashlane - ⛔ example api example cli
• Devolutions Password Server - 💵 python sdk
• Google SmartLock - ⛔ only for android
• IT Glue Password Vault - 💵
• Keeper - 💵 cli/sdk
• KronTech Single Connect
• Norton Identity Safe
• Passwordstate - 💵 api docs
• PasswordStore (Pass)
• Pleasant Password Server - example client
• RoboForm
• SplashID Safe
• Teampass - Keepass for Teams
• Trend Micro Password Manager
• Vault
• XTon PAM

OS

• Linux - Keyring
• Linux - Secretservice
• Windows - Credential Manager/ Password vault
• Mac - KeyChain

Local

• Chrome
• Firefox
• keepass
• gopass
• Password Safe
• Buttercup

Versioning

We use SemVer for versioning. For the versions available, see the tags on this repository.

Authors

Jason Kulatunga - Initial Development - @AnalogJ

License

• Dual-Licensed
  • GPL
  • MIT - Contact jason@thesparktree.com for more information.
• Logo: Octopus by Alice Noir from the Noun Project

References

• https://github.com/keybase/go-keychain
• https://github.com/99designs/keyring
• https://github.com/tmc/keyring
• https://github.com/sethvargo/vault-token-helper-osx-keychain
• https://github.com/cloudflare/gokey
• https://github.com/havoc-io/go-keytar
• https://github.com/olekukonko/tablewriter
• https://github.com/lastpass/lastpass-cli
• https://github.com/cyberark/conjur-api-go
• https://github.com/hoop33/go-cyberark
• https://cla-assistant.io/
• https://github.com/cyberark/summon
• https://medium.com/learning-the-go-programming-language/writing-modular-go-programs-with-plugins-ec46381ee1a9
• https://thycotic.force.com/support/s/article/Accessing-Secret-Server-programmatically-Curl
• https://thycotic.com/wp-content/uploads/2014/04/SS_WebServicesGuide.pdf
• https://github.com/robertknight/1pass
• https://discussions.agilebits.com/discussion/89740/api-to-pull-1password-information
• https://github.com/1Password/1password-teams-open-source
• https://www.gartner.com/reviews/market/privileged-access-management-solutions
• https://www.bomgar.com/docs/privileged-identity/documents/privileged-identity-programmers-guide-5-5-3-1.pdf
• https://www.beyondtrust.com/partners/become-a-partner/
• https://discussions.agilebits.com/discussion/30286/mrcs-convert-to-1password-utility/p1?new=1

Possible Names

• Seer
• invoke
• incant
• despell
• arcane
• shroud
• keyhole - https://thenounproject.com/search/?q=keyhole&i=200437