Ssh – Can KWallet manage the ssh passwords

kdepasswordSecurityssh

I need a way to store some SSH passwords. Note that these are login passwords which I need to pass to ssh; key authentication is unfortunately not an option. I'd like to be able to have KWallet fill them in for me somehow, because I think Gnome-keyring can do this. Does anyone know if KDE has this functionality in KWallet? And if so, how I can set it up to make use of it?

Best Answer

I don't have KDE handy but I poked at gnome-keyring a little bit and it looks like it accomplishes this by providing the ssh client with an alternate askpass program.

Check the value of $KWALLET_ASKPASS from your terminal in KDE. If it is set to something try this: export SSH_ASKPASS=$KWALLET_ASKPASS.

If not look around through your distro's packages and see if there is an askpass replacement program associated with kwallet. If so, set SSH_ASKPASS to that program.

Related Solutions

Command-line password manager that uses SSH key to authenticate

I like using KeePass, but it doesn't support command-line usage directly. It does sport an API though, and some others have tried to mend the problem by supplying a command-line frontend using that API. All pulled from the forum thread

A python frontend to the Keepass API: python-keepass
KPcli

Other:

Password Gorilla, written in tcl/tk, supposed to handle command-line usage based on pwsafe.

None of them are able to use your ssh key, probably since password storage isn't really a prime candidate for public key encryption (even though it certainly would be convenient). With KeePass it's possible to use your private ssh keyfile as additional cryptographic tie-down, but that's more for adding complexity rather than reducing it.

Ssh – How to solve this ssh-agent problem

What is meant to happen is:

You start a gnome session, part of that a gnome-keyring daemon (which also acts as a ssh agent) starts and the environment of anything started during that gnome session is updated with information on how to contact that ssh agent. The password you issue upon graphically logging in is used to unlock the default keyring.

When you use gnome-keyring as a ssh-agent, you don't want to use another agent like ssh-agent.

When your X session terminates, so does gnome-keyring. But your tmux session remains. Then, even if you start another gnome-keyring or ssh-agent, the environment of the processes already started by tmux won't be able to talk to it unless you update their environment with the path of the new socket.

What you could do is:

gnome-keyring-daemon -r > ~/.gkr

And do . ~/.gkr in all the shells you want to use the new gnome-keyring

Beware though of which DISPLAY that gnome-keyring-daemon is going to connect to.

Best Answer

Related Solutions

Command-line password manager that uses SSH key to authenticate

Ssh – How to solve this ssh-agent problem

Related Question