Passbolt is an Open Source Password Manager Built Specially For Teams

Sharing a login with a teammate often means pasting it into a chat, dropping it in a spreadsheet, or pinning a note somewhere everyone can see.

That works until a password changes, someone leaves the team, or your credentials get leaked thanks to an employee's hasty story post on social media.

Passbolt is built for exactly that problem. You might remember it from our Linux password managers list, where it was listed as the go-to for businesses and teams.

💡

If you were looking for solutions that are tailored for individuals, then Proton Pass (partner link) and AliasVault are good picks to consider.

No password woes?

Passbolt is the creation of Passbolt SA, a company based in Luxembourg. It lets teams store and share logins and other secrets, making them accessible from one place, reducing the chances of team members being served expired or exposed credentials.

Underneath, it uses OpenPGP for encryption, and you log in with two things, a private key and a passphrase. Every person with access to a secret gets their own separately encrypted copy of it.

To use it in a browser, you will need to install its extension, which takes care of the security-sensitive operations and auto-fills logins on websites.

But there's something you need to know.

The Community Edition is open source, available on GitHub under the AGPL-3.0 license, and so are the browser extension, the mobile apps, and the Docker and Helm setups.

Then there are the paid plans. Pro and Enterprise are the self-hosted ones, and Cloud Business, Cloud Sovereign, and Cloud Enterprise are hosted by Passbolt. They add things like SSO, account recovery, and activity logs on top of what the Community Edition offers.

Passbolt says the Pro and Enterprise editions use the AGPL license too. Its GitHub organization lists no separate repositories for them. Pro also needs a subscription key to run, and you lose updates and support once the subscription ends.

Trying the Passbolt Cloud

I signed up for the Cloud Business trial by filling out a form with my full name, email address, organization name, and the workspace URL I wanted all my content stored under.

Passbolt also asks you to give consent to it storing and processing this personal information in line with its privacy policy.

Once submitted, I was notified that an email with instructions was on its way.

I followed the link in it, after which a configuration page took over, running through a few steps before it let me get in without setting a password. Passbolt then nudged me to install its browser extension.

The browser extension

Seeing that I was on Vivaldi, it automatically showed me a download button to get the Chromium version of the extension installed. Before adding it, I went through the permissions it asked for.

It requests a broad set, covering reading and changing all my data on all websites, modifying the data I copy and paste, and managing my downloads.

After reviewing the permissions the extension required and accepting them, I was taken into the passphrase and security token configuration phase, where I had to pick a passphrase, followed by a security token made up of a color and three characters.

Managing entries

Now that I was logged in, I started adding new entries. They are created from the blue "Create" button at the top-left, and the types are diverse, including Passwords, TOTPs, Custom Fields, Pin Codes, and Notes. I started populating Passbolt with some social media-related logins.

The new entry form for passwords offers a lot of customizability. I could set the name, URI, username, and password, along with a color and an icon for the entry.

The generator is very useful too, letting me set the length, pick the character types to include, and even switch to passphrases for more flexibility when creating new accounts.

When I saved an entry, Passbolt asked for my passphrase, with the security token I had picked sitting right next to the field. It can also remember the passphrase for a while, with choices running from 5 minutes to staying remembered until I log out.

Sharing, exporting, and deleting can be done in batches as well. You just select the entries and pick an option from the toolbar above the list, and when you delete, Passbolt cautions that the entry is removed permanently and cannot be recovered.

Autofilling passwords

Next, I checked out the autofill feature through the browser extension. When I went to log in to Threads, it said no passwords were found for the current page and did not suggest the saved credential. I had to search for it manually, and only then did it fill in the login form once I clicked "Use on this page."

That came down to the entry's URI, which I had saved as threads.net while the login page sat on threads.com.

I could also add new entries from the extension and browse through the filters, groups, and tags from my account.

Collaborating with others

I then tried my hand at the highlight of the tool, collaborating with other team members.

For this, I went into the "Manage Users & Groups" menu accessible via the gear button on top-right and invited a colleague for collaboration (shown as P).

He received an invitation email, and once he was set up, I gave him access to a specific folder I had created (Passbolt Collaboration Test), filled with credentials I had imported.

To do that, I used the "Share" option found by right-clicking on the folder, where I typed his name into the field, giving him the read permission.

P could access the folder without much fuss, and with the permission he had, he could not edit any entries but could copy the username, password, URI, and permalink for an entry.

From the same Users & Groups menu from earlier, I could also promote him from User to Admin, giving him control over the workspace's users and settings, or suspend his account when needed.

Interested?

To try Passbolt Cloud, you sign up with your name, email, organization name, and a workspace URL. The 7-day trial starts automatically without Passbolt pestering you for your credit card info.

Sign Up Now!

After that, paid options include Cloud Business, which costs $5.4 per user per month on a monthly plan, or $4.9 if you go yearly. Cloud Sovereign is $8 per user per month billed annually, and both need at least 10 users.

You can also get a custom quote tailored to your setup via Cloud Enterprise.

If you would rather host it yourself, the Community Edition is free with no cap on users, and you can install it on Debian, Ubuntu, Docker, Kubernetes, Red Hat, AlmaLinux, and more.

Pro adds extras like SSO and LDAP provisioning, and it costs $4.9 per user per month billed annually for a minimum of 10 users.

Browser extensions are also available for Chromium browsers like Chrome, Brave, Edge, and Vivaldi, as well as Firefox and Safari. There are apps for iOS and Android too, and the only desktop app is for Windows ☹️.

As an alternative, Linux users can make use of the CLI tool Passbolt offers.

from It's FOSS https://ift.tt/ZSN8a1n
via IFTTT

FOSS Weekly #26.45: Fedora 45, Immutable Ubuntu, Mint New Feature, Dual Boot Without USB and More Linux Stuff

Fedora 45 arrived about two weeks late, but it’s packed. You get Linux 7.2, GNOME 51, and Plasma 6.7, plus kmscon replacing the old text console and a QR code that now leads to a page for kernel panics.

Could Ubuntu go immutable? Canonical has restarted Ubuntu Core Desktop, a snap-based system that stays locked down, and a dedicated team is now working on it. Both it and a proposed LTS firmware package are still early.

Ubuntu and many other distros turned hibernation off by default years ago, partly because it was slow. Linux Mint is bringing it back, with a few useful tweaks..

KDE Linux will load the ntsync kernel module by default. It gives Wine and Proton a closer match to Windows sync primitives, which can substantially boost performance.

A ministry merger ended Denmark’s Collabora pilot before its evaluation, Collabora says. It adds that the result shouldn’t count against the suite, and it says the first phase worked well.

France’s National Assembly has backed a tax of 5.5 euro cents per gigabyte delivered to French internet subscribers. VideoLAN, the nonprofit behind VLC, says it could cost over €1 million a year.

Nitrux is warning users that nitrux.org is an unaffiliated, AI-generated site using its name and logo.

Serious about using Ubuntu Linux on servers? Mastering Ubuntu Server book has now been updated for Ubuntu 26.04 LTS. The new version is available on Amazon.

This bestseller book is written by Jay LaCroix, of LearnLinuxTV and Ken VanDine, Staff Engineer at Ubuntu. From the Linux fundamentals to Ansible, MicroK8s and even Local AI with Lemonade, the book covers it all.

Mastering Ubuntu Server

🧠 What We’re Thinking About

There are two trends I am noticing. More European countries are opting for open source software in public institutions.

Latest in this list is the news that schools in six German states can now sign up for a Nextcloud-based cloud run by IONOS in German data centers. The four-year contract is open to other states later, and schools aren’t required to join.

The next trend is to use AI for creating open source alternatives to mainstream software as a service platforms like Adobe and Microsoft. Take the example of Puter’s new everything repo that offers more than 50 open source web apps, under MIT, that you can use in the browser or self-host.

🧮 Linux Tips, Tutorials, and Learnings

You don’t need a full VPN app for occasional use on Linux. Vivaldi with Proton VPN, Firefox’s built-in VPN, and Opera all offer free browser-only options.

The mv command has an interesting new option that lets you swap two files or directories. No need for the usual 3 steps with temp file in between.

Here's a collection of projects that let you run Linux directly on Apple Silicon Macs. My pick would be Fedora Asahi Remix, which works best, with nearly everything functional on M1 and M2 machines, while M3 support is still new.

👷 Homelab and Hardware Corner

You can give every container in your homelab its own name instead of an IP and port by using Tailscale Services.

In other news, Raspberry Pi has yet again raised prices, this time on its 16GB Raspberry Pi 5, which goes up $80 to $385. The 16GB Compute Module 5 also sees a $40 hike.

✨ Apps and Projects Highlights

Remember Wubi? Libertix brings that idea back, letting you install Linux Mint or Zorin from inside Windows without a USB drive.

📽️ Videos for You

Kitty is awesome. Here is a video that shows the tweaks to make it even more awesome.

Subscribe to It's FOSS YouTube Channel

💡 Quick Handy Tip

The "Hide tabs and sidebar" option on Firefox merges the top tab bar into a slim vertical ribbon along your screen's edge. Hiding the top tabs frees up valuable vertical space, expanding your main view while keeping any open tabs reachable via a quick hover.

To turn it on, right-click the top toolbar, pick "Customize Toolbar," and drop the Sidebar button onto your bar. Click the new icon, right-click inside the sidebar, choose "Customize Sidebar," and enable the "Hide tabs and sidebar" option to collapse everything instantly.

🎋 Fun in the FOSSverse

Our Shortform Showdown puzzle will have you identify a series of short forms or abbreviations for commonly used Linux tools, commands, and concepts.

GRUB is King.

📆 Trivia Bit: In 1952, CBS used UNIVAC to forecast the presidential race. Its early call gave Eisenhower 438 electoral votes to Adlai Stevenson’s 93, but the team held it back because the result looked implausible. Eisenhower ultimately won 442 to 89.

🧑‍🤝‍🧑 From the Community: The thread by Pro FOSSer Ernest about who uses AI and what one understands about it is still going strong. Do you have anything to add to the conversation?

from It's FOSS https://ift.tt/QwrsOtR
via IFTTT

This Overlooked Linux mv Option Replaces Three Commands With One

Every Linux user has done the three-step dance at least once. You want to swap two files, so you move the first one to a temporary name, move the second one into its place, and then move the temporary file back.

Ever felt that this is a bit... clumsy? And for a moment, one of your files simply doesn't exist. That doesn't feel right!

Since version 9.5, GNU coreutils has a better way: mv --exchange.

In this article, I'll show you what it does, how to check if your system has it, where it actually helps, and the mistake I made the first time I used it on directories.

The old way: three moves and a temporary name

Let's say you have two configuration files, nginx.conf and nginx.conf.new, and you want the new one to take the place of the old one while keeping the old one around.

The classic approach looks like this with the mv command:

mv nginx.conf nginx.conf.tmp
mv nginx.conf.new nginx.conf
mv nginx.conf.tmp nginx.conf.new

There are two problems here:

• There is a gap. Between the first and second command, nginx.conf doesn't exist. If a service reads it at that exact moment, it finds nothing (and trust me, one day that will happen).
• It can fail halfway. If the second command fails, you are left with a temporary file and a half-finished swap to clean up by hand.

The exchange option does this in a single command:

mv --exchange nginx.conf nginx.conf.new

Swap files with mv --exchange

The --exchange option tells mv to swap the two paths in a single operation. On Linux, it uses the kernel's renameat2() system call with the RENAME_EXCHANGE flag, so the swap is atomic: at any moment, both names exist and point to a file.

Check if your mv supports it

First, check your coreutils version:

mv --version

On my machine, running NixOS, I get:

mv (GNU coreutils) 9.11

You need version 9.5 or newer. Careful here: version numbers are not decimals. They are compared part by part, so 9.11 (nine point eleven) is newer than 9.5. You can also check whether the option is listed in the help:

mv --help | grep exchange

If this prints nothing, your mv doesn't have the option yet. I'll talk about which distributions ship it later in this article.

Swap two files

Let's create two small files to test:

echo "config A" > a.conf
echo "config B" > b.conf

Now swap them:

mv --exchange a.conf b.conf

Check the result:

cat a.conf b.conf

config B
config A

That's it. The contents traded places in one command, and no temporary file was involved.

Swap two directories (and the mistake I made)

It works for directories too, which is where it really shines. But the first time I tried it, it failed:

mkdir release-old release-new
touch release-old/v1 release-new/v2
mv --exchange release-old release-new

mv: cannot exchange 'release-old' and 'release-new/release-old': Unknown error -1

Look at the second path in the error: release-new/release-old. When the last argument is an existing directory, mv assumes you want to move things into it, just like a regular mv. So it tried to swap release-old with a path inside release-new that doesn't exist.

The fix is the -T (--no-target-directory) option, which tells mv to treat the last argument as a plain name instead of a destination folder:

mv -T --exchange release-old release-new
ls release-old release-new

release-new:
v1

release-old:
v2

Now the whole directory trees were swapped, no matter how many files they contain, because only the names changed.

Where it actually helps

Here are a few situations where I find mv --exchange useful:

• Rolling out a new configuration. Swap the new config into place and keep the old one under the other name, ready for a quick rollback with the same command.
• Switching release directories. If you deploy a new version of a site into a separate folder, you can swap it with the live folder in one step (remember the -T).
• Undoing a swap. Running the same command again swaps the files back.

Limitations you should know

mv --exchange is not magic, and a few things can trip you up.

Both paths must be on the same filesystem

The swap only works when both files live on the same filesystem. If you try to exchange a file on one filesystem with a file in a tmpfs mount like /dev/shm, the kernel refuses the operation:

mv --exchange b.conf /dev/shm/x.conf

mv: cannot exchange 'b.conf' and '/dev/shm/x.conf': Unknown error -1

The message is not very helpful (it is the same "Unknown error -1" we saw in the directory mistake above), so it's worth knowing the real reason: the kernel can't swap names across two different filesystems.

Regular mv gets around this by copying the file and deleting the original, but that can't be done atomically, so --exchange doesn't even try.

The filesystem must support it

The underlying system call needs filesystem support. Common Linux filesystems such as ext4, Btrfs, XFS and tmpfs support it.

Conclusion

mv --exchange is one of those small additions that removes a whole category of fiddly, error-prone shell work. If you are on a recent distribution like NixOS, Fedora or Debian 13, it is already on your system.

Next time you reach for a temporary file name to swap two things, try mv --exchange instead. Just remember to add -T when you swap directories.

✍️

Igor Giamoniano is a developer and teacher from São Paulo, Brazil. He contributes to the Brazilian Portuguese translation of the Linux kernel documentation and runs Coisa de Dev, where he teaches Linux and programming to a Brazilian audience. You can find his open source work on GitHub.

from It's FOSS https://ift.tt/3XKrNFl
via IFTTT

Systemd Wants Rust in, But its Core Will Have to Wait

systemd, the init system and service manager that most mainstream Linux distributions use, has merged support for writing its programs in Rust. It landed on the main branch through a pull request of 19 commits.

The pull request replaces an earlier proposal and follows rules the maintainers agreed upon at a recent hackfest in Berlin.

The first program to use it is systemd-keyring-setup, and it adds X.509 certificates to kernel keyrings, such as the dm-verity and fs-verity ones, at boot before locking them down.

If you remember, we recently talked about Amutable launching a preview for their new offering. Anyhow, let's see what they are up to now.

Rust, but on systemd's terms

With the approach they are following, Rust stays optional, and systemd can still be built without it.

The Rust code's scope is limited to new standalone programs that nothing else depends on, while everything builds with meson, excluding cargo from the equation. Only the core and libc crates are allowed, and that rules out the standard library and alloc.

Programs would use systemd's own Box and Vec types, and a failed allocation would return an error instead of panicking. A Rust program must also behave like its C counterparts, with a test checking this for programs that declare the same command.

Building Rust programs involves having rustc 1.85, bindgen 0.71.1, and meson 1.4.0 or newer.

Distributions that build systemd with every feature enabled, such as Arch and openSUSE OBS, will have to install the Rust toolchain or turn Rust support off.

The shared library problem

The library that systemd's programs share, libsystemd-shared, stays in C for now. Putting Rust in it would need proper shared library support from Rust itself, and the language still has no stable ABI.

Rust programs use that C library the same way C programs do, and putting Rust inside it would duplicate the same code across the library and many of systemd’s binaries.

Filesystem access is another hurdle, since systemd looks up paths through file descriptors to keep that step secure and does not accept Rust's standard path handling for its sensitive components. It would like Rust to support that approach as well.

systemd still wants Rust in its core and says it is open to work with the Rust community to get there.

A wave of rust

systemd is not the only part of the Linux stack making room for Rust.

The memory-safe language entered the Linux kernel with 6.1 as an exploratory effort, with the kernel maintainers declaring late last year that the experiment was over.

Ubuntu has been taking the same route with its core tools since some time now, when sudo-rs and uutils coreutils became the default experiences.

All that strongly suggests that the adoption of Rust will only accelerate as we go into a very busy 2027.

from It's FOSS https://ift.tt/5VEis61
via IFTTT

Schools That Say No to Google’s AI Will Be Saying Goodbye to its Search Too

Google is switching off Gemini, Gemini Notebook, Gemini in Classroom, and Search for K-12 student accounts by default. They stay off until a school admin turns them on, and each service can be manually enabled on its own.

But Search is where things get awkward.

As you already know, Google has built AI into it. They say that AI Mode and AI Overviews will guide students through problems step by step in school accounts. That leaves schools that want no AI without Google Search.

Google's VP for Education, Chris Phillips, told The New York Times (paywalled) that students at such a school would be shown a notice from the school saying Search is unavailable.

Some more details

Just a placeholder image of Google Classroom.

Starting 2027, schools whose admins turn on AI will get two Search options, one similar to the consumer version with AI overviews and chats available and the other built around Guided Learning, the student version of Gemini.

It would work as a study coach that asks students questions and breaks problems into steps instead of simply handing over answers. Google's post promises schools more details are coming over the next few months before any of this rolls out.

The August changes

Gemini in Classroom opened to students of all ages in August, and the Gemini tab was on by default at schools that already allowed students to use Gemini, while schools that had it off for students kept it off.

Before that, Gemini had only been on for students 18 and older, and admins who wanted it turned off for under-18 users could place them in a separate unit and disable access there.

The change announced now reverses that default.

Two of the largest districts in the U.S. have already acted before this came about, with New York City announcing a ban on student-facing generative AI tools for preschool through eighth grade and Los Angeles Unified blocking them on district-issued devices.

Germans do it differently

A four-year framework contract awarded to IONOS after a recent public procurement process lets schools in Berlin, Hamburg, Hesse, Bremen, North Rhine-Westphalia, and Rhineland-Palatinate opt into a cloud built on Nextcloud's open source software.

No school or school authority is mandated to use it, and the tender specifically asks for software released under an open source license approved by the OSI, citing digital sovereignty and the freedom to change providers.

The distinction that I am trying to make here is that a school in the U.S. that wants Search from Google will have to take its AI along once the changes roll out, whereas the German framework lets schools opt in or stay out.

---

Suggested Read 📖: Denmark’s Collabora pilot was never the Microsoft replacement it was made out to be.

from It's FOSS https://ift.tt/5BfC4n2
via IFTTT

Local AI Weekly #8: All Your RAM Are Belong to Us

Sam Altman, the OpenAI CEO, said it's "quite terrible" that so much of the world's limited DRAM sits in personal computers that use it maybe 5% of the time. In his view, it would do more work in a data center.

My take? Idle RAM is the price of owning your computer. Nobody can rent it out from under you, raise its price or switch it off. That ownership is the reason this newsletter exists.

This is a short edition, though. I've been busy lately and couldn't explore much. But there's still enough here to keep your RAM busy for more than 5% of the time. Take that, Altman.

🔍 Discover AI tools

Superwhisper is now on Linux. The popular Mac dictation app now has a native Linux app for system-wide voice input. You can transcribe locally on your own CPU or GPU, or send audio to the cloud for speed. It is NOT open source software.

voiceio is for anyone who'd rather stay open source. This MIT-licensed offline dictation app streams text into whatever app you're using, on both Wayland and X11. It can also fine-tune its model on your own recordings while your computer is idle, and switches to the new model only if it scores better.

OpenKruise Agents is for running AI agent sandboxes on your own Kubernetes cluster. Interesting part is that your API keys never enter the sandbox. An egress proxy pulls them from Kubernetes Secrets and adds them to each request on its way out. It also adds L4/L7 egress rules and an allowlist for MCP tools, so a prompt-injected agent can't wander into your internal network. Overkill for a laptop. Worth a look if you self-host agents for a team.

🐧 AI in the kernel

Linux 7.4-rc1 is out, and its merge window was the biggest on record. 19,671 commits, against 16,267 for 7.3.

Torvalds credits a wave of fixes for bugs that AI found. He'd rather get them during the merge window than as late fixes in the RC stage, and called that a much healthier model. He also admits it may not be all AI. 7.4 is expected to be the next LTS kernel, and a third of the patch is AMD GPU register headers.

👀 Big Tech Watch

Now you know why Altman is eyeing your RAM.

Nikkei Asia reports that off-balance-sheet AI obligations at Alphabet, Microsoft, Amazon, Meta and Oracle grew 90% in six months, to about $3.2 trillion. All those signed data center leases that haven't started yet, plus orders for chips and servers. If they show it in the balance sheet, their shares will tank even further.

Trillions of dollars in data centers need a lot of RAM to fill them. Yours included, apparently (as per Sam Altman).

🗂 AI Jargon: KV cache

When a model generates text, it stores some working data for every token in the conversation so it doesn't have to recalculate it. That store is the KV (key-value) cache.

It grows with context length. That's why a model that runs fine in a short chat can run out of memory once you paste in a long document.

😂 Meme

Plenty more of the memes on our Instagram page.

What are you exploring on Local AI these days?

from It's FOSS https://ift.tt/yAOWvsg
via IFTTT

Linux 7.4’s Merge Window is Huge, and Linus Says it Might Not Just Be AI

The story starts when Linus Torvalds opened the Linux 7.4 merge window more than two weeks ago when he was headed out for his annual family vacation, resulting in some temporary disruptions to his work.

He warned that his schedule would be unusual and that merging might need an extra week, but RC1 still arrived according to the usual two-week schedule.

None of that made the window any smaller. By his count, it brought in almost 20,000 commits, where 15,000 or so is the usual number, while the shortlog alone ran to 24,000 lines.

How big is it?

Sourced from Phoronix.

Phoronix went back through every merge window since Linux 3.1 in 2011 and counted the commits in each, with Linux 7.4 coming out on top at 19,671 and Linux 7.3 holding the previous high at 16,267.

That did not come out of nowhere, since every window after 7.0 has topped the one before it, with 7.4 beating 7.3 by more than 3,400 commits.

Development cycles across kernel releases show the same trend, with Linux 7.3 being the first to pass the 20,000 commits mark at 20,260 and the 7.4 window coming quite close to it.

Why?

Linus thinks AI is the reason, pointing to a surge of work set off by AI tools, including bug fixes and a growing number of patches the tools suggested, although those often end up rewritten.

He prefers receiving that work up front in the merge window over dealing with it as late fixes during the release candidate stage. He also hopes that the bigger window means AI fixes are turning into an ordinary part of development.

AI is not his only explanation. He says the expectation that 7.4 will be the next long-term support release may have played a minor role in its size, treating it as a separate driving factor.

What's included?

AMD GPU header files, which hold register definitions, account for about a third of the patch, and Linus tells people to ignore them. Drivers make up about half the patch, or roughly two thirds with the AMD headers counted.

The rest covers core areas such as networking, Rust, BPF, and memory management, along with filesystems, tooling like perf and selftests, and architecture updates.

The source tree grew along with it. By Phoronix's cloc count, the tree stood at 41,605,120 lines ahead of RC1 on November 1, up from 41,019,555 when Linux 7.3 came out.

Actual code accounts for roughly 455,000 lines of that, with the rest being blank lines and comments.

---

Suggested Read 📖: The latest releases of openEuler come with a heavy dose of AI agents.

from It's FOSS https://ift.tt/AtaqniC
via IFTTT