Welcome!
Important information
-- Spectre and Meltdown vulnerabilities
-- Change in MX sources

News
-- MX Linux on social media: here
-- Mepis support still here

Current releases
-- MX-17.1 Final release info here
-- antiX-17 release info here

New users
-- Please read this first, and don't forget to add system and hardware information to posts!
-- Here are the Forum Rules

Gnome-keyring - unlocked

Message
Author
User avatar
fehlix
Forum Guide
Forum Guide
Posts: 2027
Joined: Wed Apr 11, 2018 5:09 pm

Re: Gnome-keyring - unlocked

#11 Post by fehlix » Wed Sep 12, 2018 7:38 pm

dreamer wrote:
Wed Sep 12, 2018 7:15 pm
That should be standard. We have a login password to protect our accounts. If some applications want to use gnome-keyring let them do it ..
Well, we have it now in MX 17 it's tested and works very well, we would need only to turn it on.
I do have some on my wishlist to improve the keyring-feature, but it's a good start to securely save credentials,
I.e. if you are not logged on, there is no good chance to break the keyring. Surely depends a bit on the quality of your log-in password.
Gigabyte Z77M-D3H, Intel Xeon E3-1240 V2 (Quad core), 32GB RAM,
GeForce GTX 770, Samsung SSD 850 EVO 500GB, Seagate Barracuda 4TB

User avatar
uncle mark
Forum Veteran
Forum Veteran
Posts: 4982
Joined: Sat Nov 11, 2006 10:42 pm

Re: Gnome-keyring - unlocked

#12 Post by uncle mark » Wed Sep 12, 2018 8:08 pm

I have a load of Mint 18 KDE and it exhibits this same behavior (kwallet) with Google Chrome the first time it's launched. I just hit cancel and carry on. Kind of a PITA, but not a big deal.
Desktop: Custom build Asus/AMD/nVidia -- MEPIS 11
Laptop: Acer Aspire 5250 -- MX-15
Assorted junk: assorted Linuxes

User avatar
dolphin_oracle
Forum Veteran
Forum Veteran
Posts: 9569
Joined: Sun Dec 16, 2007 1:17 pm

Re: Gnome-keyring - unlocked

#13 Post by dolphin_oracle » Wed Sep 12, 2018 9:03 pm

fehlix wrote:
Wed Sep 12, 2018 4:45 pm
Gnome-keyring - unlocked
Enable secure password store with gnome-keyring to avoid keyring prompt

Gnome-keyring’s default password-stores used by different apps like Chrome/Chromium and other can be setup in such a way that they automatically get unlocked during session login.
Within MX Linux we are already prepared to enable and use this auto-unlock feature provided by the Pluggable Authentication Modules (PAM) mechanism:
After the user enters the login password the pam-library will unlock the login-keyring managed by the gnome-keyring subprocess. To turn PAM on we have only to install the package libpam-gnome-keyring. Use either MX Package Installer, Synaptic or the CLI to install the package:

Code: Select all

sudo apt-get install libpam-gnome-keyring 
After logout and login do open „Password and Keys“ to verify that the newly created Login-keyring is automatically unlocked.

Only one keyring : Login keyring
If no other password-store keyring is already in use the Login-keyring will also become the default password-store keyring.
Right click with the Login-keyring to verify / set it to default password store.
1_kr-login-empty.png
When you open an application which requires to save/fetch it’s credential into/from the default password-store keying the keyring to store passwords will be used.
E.g. open Chromium and you‘ll see that Chromiums internal encryption keys get stored within the default (login) keyring:
2_kr-login-default.png

Default keyring already exists
If you already have a password-store “Default keyring” in use by chromium, which holds your passwords and chromiums internal encryption keys you can secure this keyring with a password and automatically unlock the keyring on application request by means of the PAM-Login-keyring mechanism.

To secure and enable auto-unlock of existing “Default keyring” used by chromium (or any other app):
- close Chromium
- open „Password and Keys“
- right click on your existing password store “Default keyring” → set default
- right click on “Default keyring” to verify or change existing password
Now the trick:
- right click on you existing “Default keyring” password store → Lock
And now - this is important:
- right click again on your existing “Default keyring” password store → Unlock
→ Click on “Automatically unlock this keyring whenever I’m logged in”
and enter the password of your “Default keyring”.

Logout, login and to verfiy with „Password and Keys“ that you login-keyring is unlocked
and you “Default keyring” is still locked.
3-kr-log-def-locked.png
Now open chromium and verify that the “Default keyring”
used by chromum get’s automaticaly unlocked.

4-ld-unlocked.png

Attched the above as PDF-file.

--fehlix
on behalf of MX Linux community

brilliant! worked like a charm thanks.

my abbreviated procedure, since I don't use the gnome-keyring for anything (except apparently chrome...)

1. install libpam-gnome-keyring
2. delete ~/.local/share/keyrings
3. logout and login.


:happy:
http://www.youtube.com/runwiththedolphin
lenovo ThinkPad T530 - MX-17
lenovo s21e & 100s - antiX-17, MX17(live-usb)
FYI: mx "test" repo is not the same thing as debian testing repo.

User avatar
asqwerth
Forum Veteran
Forum Veteran
Posts: 3442
Joined: Sun May 27, 2007 5:37 am

Re: Gnome-keyring - unlocked

#14 Post by asqwerth » Wed Sep 12, 2018 11:54 pm

uncle mark wrote:
Wed Sep 12, 2018 8:08 pm
I have a load of Mint 18 KDE and it exhibits this same behavior (kwallet) with Google Chrome the first time it's launched. I just hit cancel and carry on. Kind of a PITA, but not a big deal.
It only pops up once in a while when I use Google Chrome (granted I only use it when a page doesn't open in FF) in my distros. Like Uncle Mark, I just hit cancel.

I find that some updates of Chrome have it, then it seems to be gone for a while, then it will resurface in another update. Because of that, I prefer to hit cancel since this keyring requirement doesn't always turn up.
Desktop: Intel i5-4460, 16GB RAM, Intel integrated graphics
Clevo N130WU-based Ultrabook: Intel i7-8550U (Kaby Lake R), 16GB RAM, Intel integrated graphics (UEFI)
ASUS X42D laptop: AMD Phenom II, 6GB RAM, Mobility Radeon HD 5400

User avatar
Jerry3904
Forum Veteran
Forum Veteran
Posts: 22653
Joined: Wed Jul 19, 2006 6:13 am

Re: Gnome-keyring - unlocked

#15 Post by Jerry3904 » Thu Sep 13, 2018 6:55 am

Thanks, fehlix--pasted this into the Wiki:

https://mxlinux.org/wiki/system/gnome-keyring

Will edit, including DO's addition
Production: 4.15.0-1-amd64, MX-17.1, AMD FX-4130 Quad-Core, GeForce GT 630/PCIe/SSE2, 8 GB, Kingston SSD 120 GB and WesternDigital 1TB
Testing: AAO 722: 4.15.0-1-386. MX-17.1, AMD C-60 APU, 4 GB

User avatar
fehlix
Forum Guide
Forum Guide
Posts: 2027
Joined: Wed Apr 11, 2018 5:09 pm

Re: Gnome-keyring - unlocked

#16 Post by fehlix » Thu Sep 13, 2018 7:15 am

Jerry3904 wrote:
Thu Sep 13, 2018 6:55 am
Thanks, fehlix--pasted this into the Wiki:

https://mxlinux.org/wiki/system/gnome-keyring

Will edit, including DO's addition
Thanks.
You might consider to add something like this foot-note somewhere:
~~~~~~
Note:
If you are changing later your login-password, you have not to forget to
to adjust also the password of the Login-keyring using „Password and keys“,
otherwise PAM cannot unlock your login-keyring automatically.
~~~~~
Gigabyte Z77M-D3H, Intel Xeon E3-1240 V2 (Quad core), 32GB RAM,
GeForce GTX 770, Samsung SSD 850 EVO 500GB, Seagate Barracuda 4TB

User avatar
dolphin_oracle
Forum Veteran
Forum Veteran
Posts: 9569
Joined: Sun Dec 16, 2007 1:17 pm

Re: Gnome-keyring - unlocked

#17 Post by dolphin_oracle » Thu Sep 13, 2018 7:34 am

fehlix wrote:
Thu Sep 13, 2018 7:15 am
Jerry3904 wrote:
Thu Sep 13, 2018 6:55 am
Thanks, fehlix--pasted this into the Wiki:

https://mxlinux.org/wiki/system/gnome-keyring

Will edit, including DO's addition
Thanks.
You might consider to add something like this foot-note somewhere:
~~~~~~
Note:
If you are changing later your login-password, you have not to forget to
to adjust also the password of the Login-keyring using „Password and keys“,
otherwise PAM cannot unlock your login-keyring automatically.
~~~~~
that's a "maybe", but probably likely since our mx-user-manager runs with root permissions by default.
When the user changes their password, the PAM module changes the password of the 'login' keyring to match.
Again, here gnome-keyring-daemon is started if necessary.

If root changes the password, or /etc/shadow is directly edited then due to the lack of the old password, the 'login' keyring cannot be updated.
http://www.youtube.com/runwiththedolphin
lenovo ThinkPad T530 - MX-17
lenovo s21e & 100s - antiX-17, MX17(live-usb)
FYI: mx "test" repo is not the same thing as debian testing repo.

User avatar
fehlix
Forum Guide
Forum Guide
Posts: 2027
Joined: Wed Apr 11, 2018 5:09 pm

Re: Gnome-keyring - unlocked

#18 Post by fehlix » Thu Sep 13, 2018 7:48 am

dolphin_oracle wrote:
Thu Sep 13, 2018 7:34 am
When the user changes their password, the PAM module changes the password of the 'login' keyring to match.
Ohh.., that's new to me. That might have been introduced recently(?) into PAM...
Gigabyte Z77M-D3H, Intel Xeon E3-1240 V2 (Quad core), 32GB RAM,
GeForce GTX 770, Samsung SSD 850 EVO 500GB, Seagate Barracuda 4TB

User avatar
dolphin_oracle
Forum Veteran
Forum Veteran
Posts: 9569
Joined: Sun Dec 16, 2007 1:17 pm

Re: Gnome-keyring - unlocked

#19 Post by dolphin_oracle » Thu Sep 13, 2018 7:49 am

fehlix wrote:
Thu Sep 13, 2018 7:48 am
dolphin_oracle wrote:
Thu Sep 13, 2018 7:34 am
When the user changes their password, the PAM module changes the password of the 'login' keyring to match.
Ohh.., that's new to me. That might have been introduced recently(?) into PAM...
hmm...if its new, it may or may not be in debian yet. we better test that.
http://www.youtube.com/runwiththedolphin
lenovo ThinkPad T530 - MX-17
lenovo s21e & 100s - antiX-17, MX17(live-usb)
FYI: mx "test" repo is not the same thing as debian testing repo.

User avatar
fehlix
Forum Guide
Forum Guide
Posts: 2027
Joined: Wed Apr 11, 2018 5:09 pm

Re: Gnome-keyring - unlocked

#20 Post by fehlix » Thu Sep 13, 2018 8:15 am

dolphin_oracle wrote:
Thu Sep 13, 2018 7:49 am
hmm...if its new, it may or may not be in debian yet. we better test that.
Cool, PAM changed by login-keyring password automaticaly in MX17.1 64bit
So no need to add this foot-note above to the wiki!
But , we better verify this in MX16/MX15 also.

Code: Select all

feh@mx:~/Desktop
$ passwd
Changing password for feh.
(current) UNIX password: 
Enter new UNIX password: 
Retype new UNIX password: 
Bad: new password is too simple
Enter new UNIX password: 
Retype new UNIX password: 
passwd: password updated successfully
Gigabyte Z77M-D3H, Intel Xeon E3-1240 V2 (Quad core), 32GB RAM,
GeForce GTX 770, Samsung SSD 850 EVO 500GB, Seagate Barracuda 4TB

Post Reply

Return to “Software / Configuration”