# GNOME Keyring

From GnomeKeyring:

  GNOME Keyring is a collection of components in GNOME that store secrets, passwords, keys, certificates and make them available to applications.

Note: Gnome Keyring does not support ECDSA keys. See Bug 641082.

## Installation

When using GNOME, gnome-keyring is installed automatically as a part of the gnome group. Otherwise install gnome-keyring from the official repositories.

## Manage using GUI

    # pacman -S seahorse

It is possible to leave the GNOME keyring password blank or change it. In seahorse, in the "View" dropdown, select "By Keyring". On the Passwords tab, right click on "Passwords: login" and pick "Change password." Enter the old password and leave empty the new password. You will be warned about using unencrypted storage; continue by pushing "Use Unsafe Storage."

## Use without GNOME, and without a display manager

### automatic login

If you are using automatic login, then you can disable the keyring manager by setting a blank password on the login keyring.

Note: The passwords are stored unencrypted in this case.

### console login

When using console based login, the keyring daemon can be started by either PAM or xinitrc. PAM can also unlock the keyring automatically at login.

#### PAM method

Start the gnome-keyring-daemon from`/etc/pam.d/login`:

Add `auth optional pam_gnome_keyring.so` at the end of the `auth` section and `session optional pam_gnome_keyring.so auto_start` at the end of the `session` section.

    /etc/pam.d/login

    #%PAM-1.0

     auth       required     pam_securetty.so
     auth       requisite    pam_nologin.so
     auth       include      system-local-login
     auth       optional     pam_gnome_keyring.so
     account    include      system-local-login
     session    include      system-local-login
     session    optional     pam_gnome_keyring.so        auto_start

Next, add `password optional pam_gnome_keyring.so` to the end of `/etc/pam.d/passwd`.

    /etc/pam.d/passwd

    #%PAM-1.0

     #password	required	pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
     #password	required	pam_unix.so sha512 shadow use_authtok
     password	required	pam_unix.so sha512 shadow nullok
     password	optional	pam_gnome_keyring.so

Note: To use automatic unlocking, the same password for the user account and the keyring have to be set.
Note: You will still need the code in `~/.xinitrc` below in order to export the environment variables required.

#### xinitrc method

Start the gnome-keyring-daemon from `~/.xinitrc`:

    ~/.xinitrc

    # Start a D-Bus session
    # Source the below file only if you do not already use the default xinitrc skeleton.
    # Otherwise you will end up with multiple dbus sessions.
    source /etc/X11/xinit/xinitrc.d/30-dbus
    # Start GNOME Keyring
    eval $(/usr/bin/gnome-keyring-daemon --start --components=gpg,pkcs11,secrets,ssh)
    # You probably need to do this too:
    export GPG_AGENT_INFO SSH_AUTH_SOCK

See FS#13986 for more info.

Note: GNOME_KEYRING_PID has been removed, and GNOME_KEYRING_CONTROL is not written if XDG_RUNTIME_DIR is set. See [1]

If you experience problems retrieving information from the keyring, make sure that the variables "DBUS_SESSION_BUS_ADDRESS" is exported in the target environment. (DBUS_SESSION_BUS_PID is no longer exported)

Instructions on how to use GNOME Keyring in Xfce are in the SSH Agents section on that page.

## Use without GNOME, but with a display manager

When using a display manager, the keyring works out of the box for most cases. The following display managers automatically unlock the keyring once you log in:

- GNOME's login manager gdm
- Slim slim
- LightDM lightdm

For KDM see KDM#KDM_and_Gnome-keyring.

If you are using the keyring to unlock your ssh keys though, make sure to configure `~/.zshenv` as shown below.

    ~/.zshenv

    if [ -n "$DESKTOP_SESSION" ];then
        eval $(gnome-keyring-daemon --start --components=ssh)
        export SSH_AUTH_SOCK
    fi

Note: The GNOME Keyring Daemon no longer exposes `GNOME_KEYRING_PID`. See commit.

## SSH Keys

To add your SSH key:

    $ ssh-add ~/.ssh/id_dsa
    Enter passphrase for /home/mith/.ssh/id_dsa:

To list automatically loaded keys:

    $ ssh-add -L

To disable all keys;

    $ ssh-add -D

Now when you connect to a server, the key will be found and a dialog will popup asking you for the passphrase. It has an option to automatically unlock the key when you login. If you check this you will not need to enter your passphrase again!

Note: You have to have a have the corresponding `.pub` file in the same directory as the private key (`~/.ssh/id_dsa.pub` in the example). Otherwise Keyring will not properly import the key without warning.

## Integration with applications

- Firefox#GNOME_Keyring_integration

## Gnome Keyring dialog and SSH

Run in a terminal, the following:

    $ gnome-keyring-daemon -s

Output will get a few lines, but in reality we are interested, `SSH_AUTH_SOCK`, example:

    GNOME_KEYRING_C.................
    SSH_AUTH_SOCK=/run/user/1000/keyring-XXXXXX/ssh
    GPG_AGENT_INF...................

Now you should add to your `~/.bashrc`, according to the output of the previous command, for example:

    SSH_AUTH_SOCK=`ss -xl | grep -o '/run/user/1000/keyring-.*/ssh'`
    [ -z "$SSH_AUTH_SOCK" ] || export SSH_AUTH_SOCK

If you run on your terminal the following:

    $ echo $SSH_AUTH_SOCK

will return something like the following:

    /run/user/1000/keyring--XXXXXX/ssh

Now when you connect with ssh, gnome-keyring dialog will launch the "entry of the passphrase"

## Flushing passphrases

    gnome-keyring-daemon -r -d

This command starts gnome-keyring-daemon, shutting down previously running instances.

## Gnome Keyring and Git

The Gnome keyring is useful in use with Git when you are pushing over https. First compile the helper

    $ cd /usr/share/git/credential/gnome-keyring
    # make

Set Git up to use the helper

    $ git config --global credential.helper /usr/share/git/credential/gnome-keyring/git-credential-gnome-keyring

Next time you do a git push, you are asked to unlock your keyring, if not unlocked already.

## Useful Tools

### gnome-keyring-query

gnome-keyring-query from the AUR provides a simple command-line tool for querying passwords from the password store of the GNOME Keyring.

Category:

- GNOME