I am using GNOME 3 on NixOS 16.09, and I cannot figure out how to make the "Login" keyring unlock automatically on login.

I suspect this could be fixed with the security.pam.services option, but I am not an expert, and the documentation is not very verbose or clear:

This option defines the PAM services. A service typically corresponds to a program that uses PAM, e.g. login or passwd. Each attribute of this set defines a PAM service, with the attribute name defining the name of the service.

Type: list or attribute set of submodules

Default: [ ]

A related but less important issue is that if I create a new user account under NixOS and log in with GNOME, no keyring is automatically created. The first time I enter a password somewhere and accept to save it in a keyring, I get a dialogue asking for a password to create a new default keyring:

Choose password for new keyring

An application wants to create new keyring called 'Default keyring'. Choose the password you want to use for it.

Note that it wants to create a keyring called "Default keyring", and not "Login", like Ubuntu does.

If I type in my login password, the keyring is created, but on the next login it is not unlocked automatically, and I am asked for a password the first time I try to use it.

Here is an analogous question about KDE Wallet, which so far has no accepted answer.

There is a relevant issue reported for Nixpkgs.


This issue is fixed in 19.03. If the login manager is GDM, then set the configuration option

{ # ...
  security.pam.services.gdm.enableGnomeKeyring = true;

It has been suggested that if no login manager is used, then the following option needs to be set:

{ # ...
  services.gnome3.gnome-keyring.enable = true;

You can use the security.pam.services.<name?>.text option.

Add to your config:

pam.services = [
  { name = "gnome_keyring"
    text = ''
      auth     optional    ${gnome3.gnome_keyring}/lib/security/pam_gnome_keyring.so
      session  optional    ${gnome3.gnome_keyring}/lib/security/pam_gnome_keyring.so auto_start

      password  optional    ${gnome3.gnome_keyring}/lib/security/pam_gnome_keyring.so

This will add the neccesary pam entry in /etc/pam.d

$ cat /etc/static/pam.d/gnome_keyring

auth     optional    /nix/store/ffcm7771dvva2xs56dzp6avxzf0pg35x-gnome-keyring-3.20.0/lib/security/pam_gnome_keyring.so
session  optional    /nix/store/ffcm7771dvva2xs56dzp6avxzf0pg35x-gnome-keyring-3.20.0/lib/security/pam_gnome_keyring.so auto_start

password        optional        /nix/store/ffcm7771dvva2xs56dzp6avxzf0pg35x-gnome-keyring-3.20.0/lib/security/pam_gnome_keyring.so
  • I tried, but the keyring is still locked on login. Does this work for you? There is a bug report about this problem for GDM (i have it with LightDM). – Alexey Apr 30 '17 at 16:27
  • You also need to use the same password for your keyring as your login I believe. It works on mine with sddm. – johnramsden May 2 '17 at 5:53
  • Which desktop manager are you using? From SDDM i cannot even log into a GNOME 3 session. – Alexey May 2 '17 at 9:16
  • I'm using KDE Plasma 5. – johnramsden May 4 '17 at 0:19
  • 1
    I have just tried with Plasma 5 and SDDM, but still i have to unlock GNOME's "Login" keyring manually each time. The password for Login keyring is the same as for the account. Strange. Thanks for the answer and for the comments anyway. – Alexey May 4 '17 at 12:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.