18

I login to Ubuntu 12.04 using a password. Later on, when I use my browser(Chrome), I'm asked for a password to unlock the keychain so that the browser can access my saved credentials for various websites (it's the same password). Also, whenever I use SSH to connect to other computers using my private key, I am prompted for the same password to unlock my private key.

How can I make it so that I am asked for my password exactly once per login (given that my login password is the same as the one I use for all my private keys)? One important requirement: all of my private keys should have a password. This means that I will have to type in one password on login, which will unlock some key which in turn decrypts the passwords for all other keys (which are also unlocked). It also means that if someone else gets access to my private keys, they will not be able to use them without at least one password.

Probably someone will try to label this question as a duplicate of this question, this question, or this question. While these questions are similar, none of them explicitly say that there still needs to be a password entered on login, as I am demanding here. As a result, the accepted solutions just say "set your passwords to blank"--I don't want that, it's dangerous! So I am aware of the similar questions, but none of them has received the correct answer yet, because they are slightly different.

Improve this question
2
  • Can you please chekc if this solves your issue? askubuntu.com/questions/78344/…
    – Bruno Pereira
    Mar 24, 2012 at 17:23
  • That solution isn't great because it requires that my most important key is not protected by a password. I updated the question to make it clear that all keys must be protected by a password.
    – conradlee
    Mar 24, 2012 at 19:00

5 Answers 5

Reset to default
5
  1. After Creating the Public Key By Following,

The first step involves creating a set of RSA keys for use in authentication. This should be done on the client. To create your public and private SSH keys on the command-line:

mkdir ~/.ssh
chmod 700 ~/.ssh
ssh-keygen -t rsa  # -t Specifies the type of key to create.  The possible values are “dsa”, “ecdsa”, “ecdsa-sk”, “ed25519”, “ed25519-sk”, or “rsa”.

You will be prompted for a location to save the keys, and a passphrase for the keys. This passphrase will protect your private key while it's stored on the hard drive and be required to use the keys every time you need to login to a key-based system:

Generating public/private rsa key pair.
Enter file in which to save the key (/home/b/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/b/.ssh/id_rsa.
Your public key has been saved in /home/b/.ssh/id_rsa.pub.
  1. You must add your private key (might be not secure) but still you can do this,
ssh-add ~/.ssh/id_rsa

Source: Ubuntu Wiki.

Improve this answer
1
4

Go to System / Preferences / Passwords and Encryption Keys to see your keyrings.

All the keys / passwords you want to unlock when you login must be in the login keyring.

If they are in other keyrings, delete them, and next time you are asked for the password there should be an option in the pop-up window to store it in the login keyring. (I think you cannot just copy from one to another, you need to delete.)

Depending on your case things may be slightly more different. If the above doesn't work then please attach a screenshot of the pop-up window you get with all advanced options expanded.

Improve this answer
1
  • 1
    This is not entirely true. They can be in any keyring, so long as it is set to be the default keyring.
    – dobey
    Apr 27, 2012 at 13:30
1

Set your keyring password to be the same as your log-in password, not blank. This will achieve your goal of unlocking the keyring on log-in, and will keep the keyring itself protected with a password as well. This is in fact, the default behavior for a new setup, so likely you changed your password at some point, or specifically set a different password on your keyring. Change one or the other so they both match, and everything will unlock when you log in.

Improve this answer
2
  • Actually, all my passwords are the same (I mention this in the question post), and yet I'm not getting the desired once-off authentication on login. Originally though, not all my passwords were the same---I made this change only after reading somewhere that that might solve my problem. It could be that I need to run some command to make Ubuntu realize that all keys use the same password. Any ideas?
    – conradlee
    Mar 24, 2012 at 23:19
  • I don't believe Chrome uses the system keyring, and has its own password store; so I don't think there is any way to have it unlock when you log in. The same is also true for Firefox. Having your ssh keys have the same passphrase as you log-in with, probably doesn't help either. However, gnome-keyring does support storing ssh key passphrases. I suppose you're confusing the concept of keyring to be a single thing for your user, when actually there are several of them. If you run <code>seahorse</code>, you can see which ones gnome-keyring is managing.
    – dobey
    Mar 25, 2012 at 2:02
0

even if you have the keyring password and your login password the same i have the same issue on ubuntu 12.04

on initial login it prompts me for the keyring pwd which i enter and all is good

however when i close chrome and re-open i get sync issues all over again

this is a known bug in windows/mac and linux:

http://groups.google.com/a/googleproductforums.com/forum/#!category-topic/chrome/report-a-problem-and-get-troubleshooting-help/SFTQBjxJX-4

when i look at my local state in /home/.config/google-chrome it says i dont exit cleanly:

"exited_cleanly": false,

Improve this answer
-3

Set a blank keyring password and you won't be bothered again.

Improve this answer
3
  • 3
    He should set the password of the keyring to the same as his log-in password, actually. Having the keyring be password protected is a requirement.
    – dobey
    Mar 24, 2012 at 22:57
  • @dobey When did that start? I remember successfully setting blank keyring passwords as late as 11.04.
    – Eliah Kagan
    Aug 14, 2012 at 11:04
  • @EliahKagan It's not a requirement of gnome-keyring for there to be a password. It was a requirement of the person asking the question here. However, using a blank password is insecure, and anyone who obtains your keyring files will be able to read your passwords out of it immediately.
    – dobey
    Aug 14, 2012 at 12:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.