Security

Note: This feature is not available in dbvr Community.

Table of contents

• Protect workspace credentials with a master password
  • Initialize secure storage interactively
  • Initialize or unlock secure storage non-interactively
  • Use DBeaver as an optional alternative
• Protect a project with a project password
  • Set a project password in DBeaver
  • Enter a project password interactively
  • Enter a project password non-interactively

Use a master password to protect workspace credentials or a project password to protect one project's settings and credentials. Both are separate from the passwords used to connect to databases.

Password	Protects	Environment variable
Master password	Credentials in workspace secure storage	DBEAVER_MASTER_PASSWORD
Project password	One project's settings and credentials	DBVR_PROJECT_PASSWORD

Protect workspace credentials with a master password

A master password protects credentials in the secure storage for a workspace. Secure storage is specific to the operating system and user.

Initialize secure storage interactively

To initialize secure storage, save a non-empty datasource password with --save-password true:

dbvr -data "<workspace-path>" datasource create \
  --driver "<driver>" \
  --host "<host>" \
  -u "<user>" \
  -p "<database-password>" \
  --save-password true

dbvr prompts you to enter and confirm a new master password. If secure storage already exists, dbvr prompts you to unlock it instead.

Initialize or unlock secure storage non-interactively

Set DBEAVER_MASTER_PASSWORD for the operation that saves the datasource password:

DBEAVER_MASTER_PASSWORD="<master-password>" \
  dbvr -data "<workspace-path>" datasource create \
  --driver "<driver>" \
  --host "<host>" \
  -u "<user>" \
  -p "<database-password>" \
  --save-password true

The environment variable supplies the master password for this operation. Setting it without saving credentials doesn't initialize secure storage.

Use DBeaver as an optional alternative

If you also use DBeaver Lite, Enterprise, or Ultimate, you can set or change the master password there. Open the same workspace in DBeaver, then select Window -> Preferences -> General -> Security -> Change password.

For information on managing a master password in DBeaver, see Managing master password.

DBeaver and dbvr must use the same workspace to share secure storage and the master password. Use -data to select that workspace when you start dbvr:

dbvr -data "<workspace-path>" <command>

Note: Separate workspaces don't share secure storage or passwords.

Protect a project with a project password

dbvr can use an existing project password to access a protected project, but it can't set or change the password. To add or change a project password, use DBeaver Lite, Enterprise, or Ultimate eitions.

A project password protects one project's settings and credentials. It's separate from the master password and the passwords used to connect to databases.

Set a project password in DBeaver

Open the project properties in DBeaver, then select Project Security -> Set password.

For information on setting a project password in DBeaver, see Project security.

Enter a project password interactively

Run a dbvr command that accesses the protected project, then enter the existing project password when prompted.

Enter a project password non-interactively

Set DBVR_PROJECT_PASSWORD for the dbvr command that accesses the protected project:

DBVR_PROJECT_PASSWORD="<project-password>" dbvr <command>