This is an old revision of the document!
Table of Contents
KeepassXC as the System Keyring
It is possible to use KeePassXC as the system keyring.
Here's how I set things up on my system using i3wm with no display manager.
Configure
- Stop gnome-keyring if it's installed.
pgrep -l gnomepkill pid
- Create a new group in the database that will hold the passwords used for the keyring
- Tools > Settings > Secret Service Integration >
- Enable KeepassXC Freedesktop.org Secret Service integration
- Database > Database Settings > Secret Service Integration > Expose entries under this group:
- Select the new group
Disable gnome-keyring
https://unix.stackexchange.com/questions/271661/disable-gnome-keyring-daemon
Create 3 .desktop files and place them in ~/.config/autostart:
- gnome-keyring-pkcs11.desktop
[Desktop Entry] Hidden=true
- gnome-keyring-secrets.desktop
[Desktop Entry] Hidden=true
- gnome-keyring-ssh.desktop
[Desktop Entry] Hidden=true
Accessing Entries
secret-tool
See secret-tool for more info.
{attribute} {value} references key:value pairs stored under the Advanced section of an Entry.
Store
secret-tool store --label='My Label' {attribute} {value} {attribute2} {value2} [...]
Get
secret-tool lookup {attribute} {value} {attribute2} {value2} [...]
keyring
See keyring for more info.
Python
import keyring
keyring.get_credential('SERVICE', 'USERNAME')
keyring.get_password('SERVICE', 'USERNAME')
cli
keyring set SERVICE USERNAME keyring get SERVICE USERNAME keyring del SERVICE USERNAME
Entries
There are different fields that are stored in the Advanced > Attributes section of each entry.
You can create your own key:value pairs for easier access and searching of specific entries.
Here's a couple examples:
Nextcloud Desktop
General
Title: Nextcloud Desktop Username: username Password: ******* URL: https://path.to.nextcloud
Advanced
Type: Password Use: Saved password or login server: Nextcloud type: plaintext user: username:https://path.to.nextcloud/:0
Thunar
You can configure access to remote filesystems for browsing in Thunar.
General
- The double
//is not a typo. - The password field should contain the password for the ssh key.
Title: username@hostname//home/username/.ssh/key Username: username Password: ********
Advanced
authtype: publickey object: /home/username/.ssh/key protocol: sftp server: hostname user: username xdg:schema: org.gnome.keyring.NetworkPassword
keyring entries
Entries created with keychain have the following attributes
General
Title: Password for 'username' on 'service' Username: username Password: ********
Advanced
application: Python keyring library service: twitter username: username
Suggestions
Given the above information, when creating an entry for use by the keyring I would recommend creating the following attributes every time for each entry:
- service: SERVICE
- username: USERNAME
This way, it will be available to python3-keyring as well.
Example
secret-tool store --label='My Label' service SERVICE username USERNAME Password:
