Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm writing an extension to a python program that will need to store passwords and need to access them during non interactive cronjobs (during the user is not logged in).

My first approach was to use seahorse to store the password. But seahorse is not accessible when the user is not logged in, is it?

share|improve this question
4  
Maybe I didn't understand the question, but why do you need to store the passwords? –  Evandro Silva Oct 16 '12 at 13:26
    
the extension I write is a framework for mounting different services like cifs, encfs, sshfs... Till now I've done sshfs with password-less ssh-keys. But other services will need passwords for login. –  Germar Oct 16 '12 at 14:39
1  
Another approach, not meeting your exact criteria so I mention it here, would be to have a machine you have safeguarded, and on which the user has signed on, periodically ssh into other computers to perform the actions you require. In partiticular you can use ssh agent forwarding while doing this to be able to do forward public key verification without putting the private key on the target computer at all. The gnome-keyring agent on the trustworthy computer does the authentication proof through its socket, which is forwarded to the target computer by ssh. Root on target still must be secure. –  John S Gruber Oct 16 '12 at 18:22
    
Wow! Complicate but nice idea. Thanks. But like you said this doesn't meet my criteria. The program is a backup tool (BackinTime) and everything that will get mounted is users property. So I definitely don't want to set up a centralized system which stores users passwords. –  Germar Oct 16 '12 at 19:54

2 Answers 2

You will probably have to store the password in a file that is only readable by root. crontab jobs run as root so they will have access, but other users of the system won't.

If it is acceptable to require the user to sign on first, you could have the user run a program to transfer the password from the gnome-keyring (seahorse) to a user owned file on a tmpfs file system. In that way it is never stored unencrypted on non-volatile storage.

share|improve this answer
    
This is what I try to avoid ;) Because even if they are readable just by root or just by the user in question, they are stored as plaintext on the harddrive. What I would like to have is seahorse get unlocked first time the user log in and from now on accepting requests from cronjobs running running with user_id –  Germar Oct 16 '12 at 15:40
1  
Agreed. But you have to store the information such that root access is enough to get at it since root access is the only privilege available to cron jobs. You can retrieve one password from the file system and then unencrypt the target password, but that doesn't really add to security, only complicates it a bit. Using a security device doesn't help either, as someone who gets root access will have access to the security device, too. OTOH, you can store the password in an encrypted local file system that is unlocked when the user boots to prevent access if the comptuer is stolen. –  John S Gruber Oct 16 '12 at 15:49
up vote 0 down vote accepted

an other approach:

A daemon start on users first time login collecting passwords from gnome-keyring and providing a private fifo (mode 0600) on which it will wait for requests (e.g. 'PROTOCOL:USER@HOST') and answer with password.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.