5

Windows and Mac both have a handy way to secure data using the users' login credentials.

  • The Data Protection API on Windows uses a symmetric key which is never stored in plain-text, and is encrypted using a key derived from the user's password. If the user logs in successfully, any program running as that user can encrypt or decrypt arbitrary data buffers; the functions to do this are part of the standard Windows API. If another user (even an admin) tries to decrypt that same data, or if the user's session was created without login credentials, DPAPI doesn't work. DPAPI keys are also permanently lost if the user's password is forcibly reset, either from within Windows, via Active Directory (LDAP), or by editing the disk.
  • The Keychain feature on MacOS provides a structured data storage mechanism for passwords and other secrets (Windows has a similar credential store, built on top of DPAPI). The keychain application itself technically has its own authentication separate from the user login credentials, but by default, MacOS synchronizes the user's login and keychain passwords and automatically unlocks keychain access when the user logs in. If the user's password is forcibly reset, the old password will be needed to unlock the keychain.

This functionality is used by lots of software, both shipping with the OS (i.e. part of the distro) and in third-party packages large or small. It's very convenient, and I wish there was some equivalent on Linux.

Is there any equivalent functionality on Linux or non-Mac Unix(-like) systems? All the suggestions I've seen talk about things like GnomeKeychain or KWallet (which require manually unlocking after login, and are desktop-specific), third-party password managers with their own master passwords and generally not integrated with anything except browsers (like LastPass), or building something on top of GPG (which requires the user to enter a password, and has no simple way to protect or unprotect data programmatically). This question from Security.SE asks the same thing, but the answer ("No") is five years old now.

Improve this question
11
  • I don't understand your question very well. Do you want a pam module to decrypt your data automatically every time you login?
    – 炸鱼薯条德里克
    Feb 3, 2019 at 9:08
  • If "equivalent" means "single central functionality supported by virtually all programs", the answer is still "no".
    – dirkt
    Feb 3, 2019 at 12:13
  • @炸鱼薯条德里克 Not "to decrypt it automatically"; the data should stay encrypted on disk at all times. Rather, imagine KWallet or similar, except that it unlocks (and thus the data can be decrypted, in memory, on demand) automatically when you log in, using the same credentials you used to log in.
    – CBHacking
    Feb 3, 2019 at 21:42
  • @dirkt Not so much "supported by" as "available to" all programs, but otherwise, yes. I'm sure lots of software would continue using various other solutions for a long time, but it would be very nice to have something that provides equivalent functionality but doesn't depend on which desktop environment you install or require additional user interaction after login. I may take a crack at writing such a PAM module myself but wanted to avoid duplicating effort.
    – CBHacking
    Feb 3, 2019 at 21:51
  • So basically a libopenssl warpper that provides an API return decrypted data everytime you call it with encrypted data and your private key (or symmetric key). If I'm right then I don't think PAM is related. PAM basically used for authentication and setup sessions, but obviously not all programs need that.
    – 炸鱼薯条德里克
    Feb 4, 2019 at 0:40

2 Answers 2

Reset to default
0

GNOME Keyring can do this, through PAM.

GNOME Keyring is integrated with the user's login, so that their secret storage can be unlocked when the user logins into their session.

Improve this answer
-1

No, there's no integrated solution. What you mean is something that could link Luks file encryption, system login and desktop keyring solution (Gnome Keyring, KWallet, etc) altogether. Unfortunately this solution doesn't exists.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .