Windows and Mac both have a handy way to secure data using the users' login credentials.

  • The Data Protection API on Windows uses a symmetric key which is never stored in plain-text, and is encrypted using a key derived from the user's password. If the user logs in successfully, any program running as that user can encrypt or decrypt arbitrary data buffers; the functions to do this are part of the standard Windows API. If another user (even an admin) tries to decrypt that same data, or if the user's session was created without login credentials, DPAPI doesn't work. DPAPI keys are also permanently lost if the user's password is forcibly reset, either from within Windows, via Active Directory (LDAP), or by editing the disk.
  • The Keychain feature on MacOS provides a structured data storage mechanism for passwords and other secrets (Windows has a similar credential store, built on top of DPAPI). The keychain application itself technically has its own authentication separate from the user login credentials, but by default, MacOS synchronizes the user's login and keychain passwords and automatically unlocks keychain access when the user logs in. If the user's password is forcibly reset, the old password will be needed to unlock the keychain.

This functionality is used by lots of software, both shipping with the OS (i.e. part of the distro) and in third-party packages large or small. It's very convenient, and I wish there was some equivalent on Linux.

Is there any equivalent functionality on Linux or non-Mac Unix(-like) systems? All the suggestions I've seen talk about things like GnomeKeychain or KWallet (which require manually unlocking after login, and are desktop-specific), third-party password managers with their own master passwords and generally not integrated with anything except browsers (like LastPass), or building something on top of GPG (which requires the user to enter a password, and has no simple way to protect or unprotect data programmatically). This question from Security.SE asks the same thing, but the answer ("No") is five years old now.

  • I don't understand your question very well. Do you want a pam module to decrypt your data automatically every time you login? – 炸鱼薯条德里克 Feb 3 '19 at 9:08
  • If "equivalent" means "single central functionality supported by virtually all programs", the answer is still "no". – dirkt Feb 3 '19 at 12:13
  • @炸鱼薯条德里克 Not "to decrypt it automatically"; the data should stay encrypted on disk at all times. Rather, imagine KWallet or similar, except that it unlocks (and thus the data can be decrypted, in memory, on demand) automatically when you log in, using the same credentials you used to log in. – CBHacking Feb 3 '19 at 21:42
  • @dirkt Not so much "supported by" as "available to" all programs, but otherwise, yes. I'm sure lots of software would continue using various other solutions for a long time, but it would be very nice to have something that provides equivalent functionality but doesn't depend on which desktop environment you install or require additional user interaction after login. I may take a crack at writing such a PAM module myself but wanted to avoid duplicating effort. – CBHacking Feb 3 '19 at 21:51
  • So basically a libopenssl warpper that provides an API return decrypted data everytime you call it with encrypted data and your private key (or symmetric key). If I'm right then I don't think PAM is related. PAM basically used for authentication and setup sessions, but obviously not all programs need that. – 炸鱼薯条德里克 Feb 4 '19 at 0:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.