Configure Setting to change the keyring

[MartinLoeper]

What I am currently missing is an option to change the keyring that is used by dcli. Currently the login keyring (default) is used.

I would like to configure my gnome-keyring to be locked automatically after several minutes.
Otherwise, I prefer to set dcli configure save-master-password false because an indefinitely unlocked dashlane vault is too risky for an enterprise environment.

[jboillot]

Hello!
I do not have the perfect solution, but here are 3 possible "workarounds":

• disable the daemon that keeps the keyring unlocked so every time it is needed it will ask for your passphrase: you have to comment out all the lines containing pam_gnome_keyring.so in the files of /etc/pam.d,
• periodically run the command dbus-send --dest=org.gnome.keyring --print-reply /org/freedesktop/secrets org.freedesktop.Secret.Service.LockService that will lock your keyring,
• or my favorite option: lock the keyring when you are inactive for too long. This can be done with sudo apt install xautolock and then xautolock -locker "dbus-send --dest=org.gnome.keyring --print-reply /org/freedesktop/secrets org.freedesktop.Secret.Service.LockService" -time <time in minutes of inactivity before lock>. You can manually trigger the lock with the command xautolock -locknow if you want to test it. Then, just add this command to be run at startup via cron.

Does any of those solutions work for you?
Jérôme

[Mikescops]

Awesome, thanks Jérôme for the answer.

I +1 this answer as I don't think the Dashlane CLI should manage the keyring options or lock status itself.

That said, it indeed uses the gnome-keyring one by default and fallback to keyutils if it is not installed. I'm not sure there is in an interest in letting users pick the Linux keyring (that keeps keys in RAM) instead of the Gnome one.

[MartinLoeper]

Thanks for the thorough reply @jboillot!

@Mikescops I just wanted to mention this because applications like aws-vault even seem to use their own gnome-keyring to enhance security. My issue with the current implementation is: As soon as I unlock my computer, the default gnome-keyring is unlocked.
Thus, everyone can instantly query the dcli after startup. Using a dedicated gnome-keyring would prevent this auto-unlock without affecting other apps for which auto-unlock is desirable.

[jboillot]

You are right that this is indeed a different issue than having the possibility to change the keyring program.
I have written a little Python script that has to be run at startup and that automatically locks the keyring after a specified amount of time (by default 5s (that is way too short, it was only for test purposes)). It spies D-Bus both to determine when the passphrase is entered and to lock the keyring. I hope it helps :)
https://gist.github.com/jboillot/5c32083bbf2aa892871f367156b40fef

Edit: I'm currently trying to create a gnome extension that does the same job.

[MartinLoeper]

Thanks @jboillot, will consider this as an alternative to not storing the secret in keyring at all :)