Ubuntu – xubuntu: stop gnome-keyring-daemon from impersonating ssh-agent

gnome-keyringssh-agentxfcexubuntu

I want to use the real ssh-agent instead of gnome-keyring in xubuntu. I followed the steps from http://dtek.net/blog/how-stop-gnome-keyring-clobbering-opensshs-ssh-agent-ubuntu-1204, but gnome keyring still registers itself as ssh-agent. I still want to keep using gnome-keyring for other passwords

Best Answer

It turns out that if gnome compatibility is turned on in xfce, xfce4-session will unconditionally start gnome-keyring-daemon. This is hardcoded, there is at the moment no way to configure this. Disabling the gnome compatibility mode results in keyring not starting on login and you will need to provide your password again if you start it.

The simplest solution seems to be to intercept the call to gnome-keyring-daemon, and insert a script that will insert the --components flag into the arguments to prevent gnome keyring from replacing ssh-add.

Run the following to move gnome-keyring-daemon:

sudo mv /usr/bin/gnome-keyring-daemon /usr/bin/gnome-keyring-daemon-wrapped

create a new gnome-keyring-daemon with 

sudo nano /usr/bin/gnome-keyring-daemon

and insert the following content:

#!/bin/sh
exec /usr/bin/gnome-keyring-daemon-wrapped --components=pkcs11,secrets,gpg "$@"

Make the new gnome-keyring-daemon executable with sudo chmod +x /usr/bin/gnome-keyring-daemon.

Now gnome keyring will no longer try to replace ssh-add.

Note that upgrading your system will reinstate the default gnome-keyring-daemon, so you will probably need to execute the above steps again after upgrading.

edit:

In xubuntu 14.10 startup works slightly different in that g-k-d is also started from the session upstart. It is possible to override the upstart configuration so it won't start the ssh component, but even so g-k-d will start its ssh component when xfce4-session also tries to start it. So if you want to have xfce also automatically start gnome services you will still need the above hack. An alternative is to disable gnome services (Setings -> Session and Startup -> advanced -> Launch GNOME services on startup), configure upstart to start g-k-d with the --components=pkcs11,secrets,gpg flag, and optionally also configure the gnome services you do want to start manually.

(Apart from the two places that launch g-k-d mentioned above, the g-k-daemon is also started before that from lightdm/PAM in order to receive the user's login password. But that launch does not fully configure g-k-d and it still expects to be fully configured by a second attempt to start it, so that start attempt is not relevant to the current problem.)

Related Question