Solution: Disable gnome-keyring using dpkg-divert
sudo dpkg-divert --local --rename /usr/bin/gnome-keyring-daemon
Next time you log in, it'll be gone. That one line is all you need, but read on for an explanation and warnings.
Short Explanation
This solution renames the program to gnome-keyring-daemon.distrib so it cannot be found.
When you log in, instead of gnome-keyring trying to handle ssh integration, password requests will go directly to ssh-agent. You can unlock your ssh key for git commits using the usual ssh-add
command.
Caveats and remorse
Gnome Keyring is deeply intertwangled with the Gnome Desktop. Without it, some things may stop functioning until a replacement is installed.
To re-enable Gnome Keyring
sudo dpkg-divert --remove --rename /usr/bin/gnome-keyring-daemon
You might be using Gnome Keyring and not know it
Many applications that can save your passwords, such as Chromium and Evolution, encrypt them using a master key stored in Gnome Keyring. Disabling Gnome Keyring prevents access to all those stored passwords. It is a good idea before disabling Gnome Keyring to backup the saved passwords.
Backing up the Gnome Keyring
You can backup your keys by copying the files in ~/.local/share/keyrings/. The secrets are encrypted so, depending upon your security stance, you may wish to back them up as plain text. To do so, use the "Passwords and Keys" program (aka "Seahorse") to temporarily set an empty password for the Login Keyring. (Tip: Seahorse hides the change password option in the right-click context menu.)
Warning: Passwords may stored in plaintext
Chromium and Google Chrome rely on a daemon called "Secret Service" to get an encryption key for saved passwords. If Secret Service is missing, which it will be once you disable Gnome Keyring, they will save your passwords unencrypted. Unlike Firefox, chromium based browsers do not currently provide a way to manually set a Primary Password.
Freedesktop.org's Secret Service Integration
Gnome Keyring is only one of the programs which can act as the Secret Service daemon. To ensure that saved passwords are encrypted in Chromium and Evolution, you can install keepassxc and enable Secret Service in the settings.
Further explanation
Why not just use chmod
or mv
?
Changes via chmod or mv will revert when the system is updated. By using dpkg, this solution will persist through anything, even an upgrade to a new release of Ubuntu.
Is there a less drastic way?
At the time of writing, it does not appear to be possible to tell Gnome Keyring to continue providing Secret Service Integration and stop messing with ssh-agent. For many people that would be ideal, so hopefully Gnome will add that option in the future.
Why other methods don't work
Over the years, many different solutions have been proposed only to be broken in the next release. Here's a short summary of why not.
Configuring Gnome Keyring
The ideal solution would be to configure Gnome Keyring to do the right thing. There actually is a command line option --components
which almost works. It allows one to specify which components to initialize:
gnome-keyring-daemon --components secrets,ssh,pkcs11
One could omit ssh from the list and, theoretically, it would not muck up ssh authentication. Unfortunately, that was not my experience. Perhaps the problem was that gnome-keyring was getting launched from multiple locations (see below), but the short of it is: there is no way to tell Gnome Keyring to never load the ssh component, only to say not now.
apt remove gnome-keyring
The obvious solution of removing the gnome-keyring package also uninstalls all the packages which depend on it, including gnome-core. While there are ways around it, it is easy to accidentally end up uninstalling the entire GNOME Desktop environment.
Multiple vectors of attack
One of the things that makes gnome-keyring-daemon so hard to kill is that it is launched via (at least) four different methods at login, each of which must be disabled in a particular way.
- PAM (Pluggable Authentication Modules) in /etc/pam.d/gdm-password
- systemd user service and socket
- systemd user session.slice in /usr/share/dbus-1/services/
- XDG autostart in /etc/xdg/autostart/gnome-keyring-*.desktop