-
Notifications
You must be signed in to change notification settings - Fork 61
Configure Setting to change the keyring #178
What I am currently missing is an option to change the keyring that is used by dcli. Currently the login keyring (default) is used.
I would like to configure my gnome-keyring to be locked automatically after several minutes.
Otherwise, I prefer to set dcli configure save-master-password false because an indefinitely unlocked dashlane vault is too risky for an enterprise environment.
All reactions
Replies: 1 comment 4 replies
Hello!
I do not have the perfect solution, but here are 3 possible "workarounds":
- disable the daemon that keeps the keyring unlocked so every time it is needed it will ask for your passphrase: you have to comment out all the lines containing
pam_gnome_keyring.soin the files of/etc/pam.d, - periodically run the command
dbus-send --dest=org.gnome.keyring --print-reply /org/freedesktop/secrets org.freedesktop.Secret.Service.LockServicethat will lock your keyring, - or my favorite option: lock the keyring when you are inactive for too long. This can be done with
sudo apt install xautolockand thenxautolock -locker "dbus-send --dest=org.gnome.keyring --print-reply /org/freedesktop/secrets org.freedesktop.Secret.Service.LockService" -time <time in minutes of inactivity before lock>. You can manually trigger the lock with the commandxautolock -locknowif you want to test it. Then, just add this command to be run at startup via cron.
Does any of those solutions work for you?
Jérôme
All reactions
-
❤️ 1
Awesome, thanks Jérôme for the answer.
I +1 this answer as I don't think the Dashlane CLI should manage the keyring options or lock status itself.
That said, it indeed uses the gnome-keyring one by default and fallback to keyutils if it is not installed. I'm not sure there is in an interest in letting users pick the Linux keyring (that keeps keys in RAM) instead of the Gnome one.
All reactions
Thanks for the thorough reply @jboillot!
@Mikescops I just wanted to mention this because applications like aws-vault even seem to use their own gnome-keyring to enhance security. My issue with the current implementation is: As soon as I unlock my computer, the default gnome-keyring is unlocked.
Thus, everyone can instantly query the dcli after startup. Using a dedicated gnome-keyring would prevent this auto-unlock without affecting other apps for which auto-unlock is desirable.
All reactions
You are right that this is indeed a different issue than having the possibility to change the keyring program.
I have written a little Python script that has to be run at startup and that automatically locks the keyring after a specified amount of time (by default 5s (that is way too short, it was only for test purposes)). It spies D-Bus both to determine when the passphrase is entered and to lock the keyring. I hope it helps :)
https://gist.github.com/jboillot/5c32083bbf2aa892871f367156b40fef
Edit: I'm currently trying to create a gnome extension that does the same job.
All reactions
Thanks @jboillot, will consider this as an alternative to not storing the secret in keyring at all :)