I am trying to use keychain on debian latest stable with some difficulty. Searching online I could not find a solution, but thought perhaps a different approach or a different tool might be better in this case.
I want to achieve something reasonably straight-forward:
- When logging in to the server as root after reboot, the user is prompted for a master passphrase once.
- This passphrase is loaded into memory and used to unlock both the
ssh private key(used for pulling code from a remote git repository, remote authentication etc) and a
gpg private key(used to decrypt some configuration parameters also coming from git).
This way, only having access to the root account or being able to dump memory would allow extracting the passphrase. As soon as the server is rebooted the passphrase is cleared. I don't have the budget/resources for an HSM or anything more elaborate. I want something simple and cheap and that works reliably and securely enough.
Keychain seems like a good candidate, but I can't get it to work properly to fulfill both requirements. Namely, it asks for the pasphrase twice, and also when trying to decrypt something with gpg it asks for it a 3rd time... Is there a way to achieve this securely with keychain or any other tool or shell script?
[p.s. not sure if this belongs on ServerFault or here]