Re: Upgrade to Bookworm, now GNOME keyring dies--no access to stored SSH key passwords
On 14/08/2023 07:30, Nate Bargmann wrote:
I have been using the GNOME keyring applet to manage the SSH public key
passwords I use as it prompts to save passwords and then lets me SSH to
other hosts without out a password prompt.
I do not know how it is arranged in Gnome, but I hope my observations
still might be helpful.
systems on my LAN and was greeted with a password prompt for the
corresponding public key
To be precise, it is the passphrase do decrypt your *private* key. A
public key may be known to anybody. Private key is a secret that allows
to prove that you have it without disclosing of this private key.
Encryption using a passphrase is a means to mitigate consequences if the
private key is stolen.
An ssh agent opens a socket and exposes its location through an
environment variable (perhaps using "systemctl set-environment", but I
am not sure). Try
env | grep SSH
There are multiple implementations of SSH agents: openssh, gpg,
keepassxc(?), perhaps gnome has more (seahorse? I am unsure concerning
the role of secrets service). It may happen that in your case multiple
instances are running:
/usr/lib/systemd/user/ssh-agent.service
/usr/lib/systemd/user/gpg-agent-ssh.socket
/etc/X11/Xsession.d/90x11-common_ssh-agent
GUI prompt may be just a proxy to an actual ssh agent. It just listens
its socket and displaying a password prompt on demand and passing other
messages literally.
Now, while typing this email all keyring PIDs have vanished!
It may be a way to minimize RAM usage. The agent may be a
socket-activated process.
systemctl --user list-sockets
Check owner of $SSH_AUTH_SOCK using ss or lsof. It may give some clue
what is really happening in your case.
I suggest you to add "f" option to "ps" to see process tree. It may help
to find details concerning starting of particular agent.
ps xwwf
P.S. At certain moment gnome designers decided that password prompt must
be a modal dialog completely blocking interaction with any other
applications (including 3rd party password manager). For me it was
another reason to avoid gnome. I am aware that X11 protocol allows to
sniff keyboard events and a measure against it is grabbing input.
However I believe mouse still may be a way to call an external password
manager. After all, there are may be an option to temporary suspend
keyboard grabbing. I learned about multiple ways to start a ssh agent
during initialization of user session when I was trying to figure out
which way GUI prompt is implemented and if a more flexible dialog could
be used instead.
Reply to: