add try-luks-from-kdbx.py

Signed-off-by: Martin Matous <m@matous.dev>

README.md

@@ -132,3 +132,16 @@ Status: one-off
 Dependencies: apparmor
 
 Usage: `sync-apparmor.py <src> <dst>`
+
+
+## try-luks-from-kdbx.py
+Retrieve known password for a LUKS volume from a KeePass DB.
+
+For those moments when you forget the name of or
+mislabel your DB entry.
+
+Status: one-off
+
+Dependencies: pykeepass
+
+Usage: `try-luks-from-kdbx.py /path/to/kdbx /path/to/block-device`

try-luks-from-kdbx.py

@@ -0,0 +1,26 @@
+#!/usr/bin/env python3
+
+import getpass
+import subprocess
+import sys
+
+from pykeepass import PyKeePass
+
+if len(sys.argv) < 3:
+	print(f'Usage: {sys.argv[0]} /path/to/kdbx /path/to/block-device\n')
+
+pwd = getpass.getpass('Enter database password:\n')
+kp = PyKeePass(sys.argv[1], password=pwd)
+cmd = ['cryptsetup', 'open', '--test-passphrase', sys.argv[2]]
+for entry in kp.entries:
+	res = subprocess.run(
+		cmd,
+		stdout=subprocess.DEVNULL,
+		stderr=subprocess.DEVNULL,
+		input=entry.password.encode()  # input accepts bytes, not str
+		)
+	if res.returncode == 0:
+		print(f'Password found: {entry.title}\npw: {entry.password}')
+		break
+	else:
+		print(f'Entry "{entry.title}" not a match')