2

I've created one password-protected RSA key to access my remote server via ssh using key-based authentication and added it to seahorse using ssh-add.

I would like to prevent seahorse from asking me for the passphrase on every login.

Is there any way to disable this? Or to enter it forever? Or to have one one user given trusted access forever?

4 Answers 4

3

Launch Seahorse, find your "login" encryption key, then right click on "Passwords: Login" and choose "Change Password".

Seahorse

Enter the old password, then hit the "Okay" button, leaving the new and confirm boxes empty. You will be prompted about "Unsafe Storage". Confirm this, and your keyring will be automatically unlocked when you log into your machine.

Note that this really is "Unsafe" and should only be used if you encrypt your home drive, as otherwise losing your laptop will equate to opening up everything it has access to - that might include your Gmail password (if you use a Gmail checker) your WIFI passwords if you connect to WIFI, IM passwords and so on. Looks like Chromium has started using it for storage too, as I seem to have a lot of site-specific stuff recorded in my keyring.

Personally I also uninstall Seahorse after setting everything up too, so that it's a little less trivial to see all my passwords in cleartext should I forget to lock my laptop!

Be careful with unsafe storage.

2
1

Here is the simple solution which worked perfectly for me on Ubuntu 18.04 LTS:

Disable "SSH Key Agent" in the autostart applet ("Startup Applications" aka gnome-session-properties):

Screenshot: Disable SSH Key Agent (in german SSH-Schlüsselagent)

Background Info: The issue is due to the key manager gnome-keyring-daemon of which seahorse is only the graphical user interface. The daemon loads the ssh key agent when the user logs in. Therefore by disabling the SSH key agent applet the daemon stops managing SSH keys stored in ~/.ssh/ . More details can be found in the SSH section of the gnome-keyring-daemon wiki

1

I know this is an old question, but I found my way here while trying to do this myself, and this seems to do the trick:

$ <seahorse_ssh-askpass> <key_path>

You want to make sure you use the ssh-askpass associated with Seahorse, and it might not be in the same place on every system, but in my case (Ubuntu 20.10) it was the following:

$ /usr/libexec/seahorse/ssh-askpass <key_path>

If this executable location doesn't work on your system, you can try the following:

$ locate ssh-askpass | grep seahorse

Which will list all files and directories containing ssh-askpass in the name and seahorse in the path. (You may need to install and set up mlocate on your system before you can run this command.)

The most common path for an SSH key is ~/.ssh/id_rsa, but you can check in the Seahorse GUI to see if it's something else. In my case, I used the following command:

$ /usr/libexec/seahorse/ssh-askpass ~/.ssh/alpha_rsa

If you execute the command successfully, it will pop up a dialogue box listing the name of the SSH key and asking for your password. In my case I got a Vala error saying it couldn't grab the keyboard, and the password I entered got printed to the terminal, but this command seems to have succeeded in making that particular SSH key unlock automatically when my GNOME Keyring is unlocked.

EDIT: it seems like maybe the more important thing was going into the Seahorse GUI, clicking OpenSSH Keys, right-clicking on the key in question, selecting "Configure Key for Secure Shell...", and adding each of the servers and usernames to use the key with. I had done this earlier today (before running ssh-askpass) but completely forgotten. Strangely, this part of the process doesn't seem to prompt for a password.

As an aside, if you don't want this to be a glaring security hole, it's worth making sure that your GNOME Keyring doesn't automatically unlock without a passphrase when you turn on your computer. In my case, I have a YubiKey with a passphrase that I have to enter before Linux can even boot. You will also want to make sure that your computer locks automatically when you're not using it. But assuming you have to enter a passphrase to boot up or log in and to unlock your computer (i.e. wake it from sleep), any SSH passphrase saved in your GNOME Keyring should be as secure as anything else in your GNOME Keyring.

0

Any solution that would stop Seahorse from asking for the passphrase would involve writing the passphrase down to the hard drive (or something else). Which means anyone who steals your computer would be able to log in (as the password is also saved somewhere). This is pretty much the same as not having a passphrase in the first place.

In short, just remove the passphrase. The point of the passphrase is that if someone gains access to your machine and steals the key, you have some time (before they bruteforce the passphrase) to invalidate the key on any machines you use it on. Removing the passphrase doesn't make the key itself less secure.

1
  • Yes, I know. But I think that it would be a nice feature that allows to add one trusted user in the same computer that it's installed the key (writing the passphrase once in trust moment). And this trusted user could use the ssh key without passphrase. In fact, there is a parameter I do not understand then what it does: (img263.imageshack.us/img263/8673/captura20110331115429.png) Mar 31, 2011 at 9:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .