User Tools

Site Tools


linux:security:keyring:keepassxc-keyring

This is an old revision of the document!


KeepassXC as the System Keyring

It is possible to use KeePassXC as the system keyring.

Here's how I set things up on my system using i3wm with no display manager.


The following information requires at least KeePassXC 2.5.0 installed.

Since I'm using Debian Stable, I had to compile the newer version myself.

Configure

  • Stop gnome-keyring if it's installed.
    • pgrep -l gnome
    • pkill pid
  • Create a new group in the database that will hold the passwords used for the keyring
  • Tools > Settings > Secret Service Integration >
    • Enable KeepassXC Freedesktop.org Secret Service integration
  • Database > Database Settings > Secret Service Integration > Expose entries under this group:
    • Select the new group

Disable gnome-keyring

https://unix.stackexchange.com/questions/271661/disable-gnome-keyring-daemon

Create 3 .desktop files and place them in ~/.config/autostart:

gnome-keyring-pkcs11.desktop
[Desktop Entry]
Hidden=true
gnome-keyring-secrets.desktop
[Desktop Entry]
Hidden=true
gnome-keyring-ssh.desktop
[Desktop Entry]
Hidden=true

Accessing Entries

secret-tool

See secret-tool for more info.

{attribute} {value} references key:value pairs stored under the Advanced section of an Entry.

Store

secret-tool store --label='My Label' {attribute} {value} {attribute2} {value2} [...]

Get

secret-tool lookup {attribute} {value} {attribute2} {value2} [...]

keyring

See keyring for more info.

Python

import keyring

keyring.get_credential('SERVICE', 'USERNAME')
keyring.get_password('SERVICE', 'USERNAME')

cli

keyring set SERVICE USERNAME
keyring get SERVICE USERNAME
keyring del SERVICE USERNAME

Entries

There are different fields that are stored in the Advanced > Attributes section of each entry.

You can create your own key:value pairs for easier access and searching of specific entries.

Here's a couple examples:


Nextcloud Desktop

General
Title: Nextcloud Desktop
Username: username
Password: *******
URL: https://path.to.nextcloud
Advanced
Type: Password
Use: Saved password or login
server: Nextcloud
type: plaintext
user: username:https://path.to.nextcloud/:0

Thunar

You can configure access to remote filesystems for browsing in Thunar.

General
  • The double // is not a typo.
  • The password field should contain the password for the ssh key.
Title: username@hostname//home/username/.ssh/key
Username: username
Password: ********
Advanced
authtype: publickey
object: /home/username/.ssh/key
protocol: sftp
server: hostname
user: username
xdg:schema: org.gnome.keyring.NetworkPassword

keyring entries

Entries created with keychain have the following attributes

General
Title: Password for 'username' on 'service'
Username: username
Password: ********
Advanced
application: Python keyring library
service: twitter
username: username

Suggestions

Given the above information, when creating an entry for use by the keyring I would recommend creating the following attributes every time for each entry:

  • service: SERVICE
  • username: USERNAME

This way, it will be available to python3-keyring as well.

Example
secret-tool store --label='My Label' service SERVICE username USERNAME
Password:

linux/security/keyring/keepassxc-keyring.1590425954.txt.gz · Last modified: by chuck