Unlock Gnome Keyring Daemon from command line

Question

I am trying to unlock the Gnome Keyring Daemon from the command line, by directly passing it a password. I tried a few variations of --daemonize, --login, --start, but I can't get it to work.

echo $password | gnome-keyring-daemon --unlock returns SSH_AUTH_SOCK=/run/user/1000/keyring/ssh but doesn't unlock anything.

Basically I want something along the lines of:

gnome-keyring-daemon unlock --pw $password

Not sure if it makes any difference, but I'm on Manjaro i3wm version, so not using a desktop environment.

Background:

I'm using KeePassXC to manage my keyring. The one downside to this is, that I can't automatically unlock the keyring on login. Since I don't want to enter two long passwords I came up with the following script as a workaround:

• Logging in automatically unlocks Gnome Keyring Daemon
• Gnome Keyring Daemon contains (a part of) the PW to KeePassXC as the only entry
• enter the last characters of the pw in a prompt
• kill Gnome Keyring Daemon
• use the combined pw to unlock KeePassXC

Now I want to do the opposite to lock KeePassXC again:

• Get PW to Gnome Keyring Daemon from KeePassXC
• Kill KeePassXC
• Unlock GnomeKeyringDaemon <- this is the part I can't get to work

Answer 1

This is a very brutal, dirty, and probably very wrong way to do this, but after struggling with unlocking my keyring over SSH for a while, I came up with this little script:

echo 'NOTE: This script will only work if launched via source or .' >&2
echo -n 'Login password: ' >&2
read -s _UNLOCK_PASSWORD || return
killall -q -u "$(whoami)" gnome-keyring-daemon
eval $(echo -n "${_UNLOCK_PASSWORD}" \
           | gnome-keyring-daemon --daemonize --login \
           | sed -e 's/^/export /')
unset _UNLOCK_PASSWORD
echo '' >&2

And yes, when I call . ~/bin/unlock-gnome-keyring and enter my login password, it unlocks my login keyring, I can view it in seahorse running through remote X and use it via libsecret applications.

Please be warned though, I'm not a security expert and there might be serious security implications to doing it this way. I did not check whether the password is properly cleaned in memory etc., which might render you more exposed to attacks.

Answer 2

There is (now) an --unlock argument to gnome-keyring-daemon which does exactly what you want. Normally, when it's invoked, it will unlock then demonize and echo the SSH_AUTH_SOCK. If you think there might already be an existing daemon running, then you can add the --replace argument to ensure a seamless transition to the new daemon.

I log in to a headless Ubuntu 20.0.4LTS system via ssh with a public key (no password) on a regular basis, but sometimes for development purposes I need the keyring to be available. So I have the following function defined in my bash profile, and it works great to do the unlock (whether there is an existing daemon running or not):

# Linux unlock gnome keyring
function unlock-keyring ()
{
    read -rsp "Password: " pass
    export $(echo -n "$pass" | gnome-keyring-daemon --replace --unlock)
    unset pass
}

Answer 3

I couldn't get any combination of the echo -n "pass" | gnome-keyring-daemon commands to work. I also tried the secret-tool command and several Python libraries, but most were outdated and none of them unlocked my keyring in Seahorse - or just triggered the GUI password prompt.

The only thing that worked for me was a Python script I found, available on Github and Codeberg, that does the job for me as long as I have Python installed. Downloading the script is as simple as running:

wget https://codeberg.org/umglurf/gnome-keyring-unlock/raw/branch/main/unlock.py
chmod +x unlock.py

After that, the following command unlocks the default keyring named 'Login' (usually present, the gnome-keyring-daemon command also creates it if it doesn't exist):

./unlock.py <<<PASSWORDHERE

If you also want to unlock a non-default keyring, just create an item in the 'Login' keyring with the name and password of that keyring. That gives you the option to automatically unlock that keyring whenever the 'Login' keyring is unlocked.