There plenty of tools working with keyrings: ssh-agent, gpg-agent, gnome-keyring, kwallet, wrappers like keychain, keyctl talking to GNU/Linux kernel. There are various recommendation on how/when to start it tailored for different environments.

This make it rather confusing. I'm using modern GNU/Linux distro with systemd and I start my user session with systemd --user as well. I expect this setup to last decades so I wonder what's the best way to get keyring into picture?

The main use-case is to store passwords from chromium/firefox in one consolidated place.

Shall I start keychain from my user shell autostart script (I use fish for interactive and dash as login shells if that matters)? Right now "gnome-keyring-daemon --daemonize --login" is spawned via PAM. Shall I start "gnome-keyring --start" from user systemd unit? Is there some dbus service which would start some keyring daemon upon first request?

The list of questions go on but you get the idea - what is the right way to get keyring-as-a-service?

  • Note that ssh-agent and keychain are for SSH keys only, gpg-agent can be used for GPG keys and optionally also for SSH keys, gnome-keyring and kwallet aim to be generic password/key/secret management systems for Gnome and KDE desktop environments respectively, and keyctl is for kernel-level key management which can be used for various purposes, including kernel module authentication to conform to Secure boot requirements. In other words, most of these are completely separate systems; among those listed, only gnome-keyring and kwallet are fully general-purpose. – telcoM Feb 2 '19 at 11:11

On my machine (debian unstable) ssh-agent and gpg-agent have their own systemd user service/socket files. That means that they should be started when the user logs in or be activated when the first time an application is trying to access them.

Regarding gnome-keyring, there is (ATM?) no such systemd file and gnome-keyring is started both by PAM (as you mentioned) and by a .desktop file located in /etc/xdg/autostart/. The services located there should be started by your session manager (gnome-session, ...).

I see on debian a package called obsession that contains a /usr/bin/xdg-autostart I personally never used that tool, but that might help you to manually start the needed components if you are not using a session manager that supports XDG specification

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.