0

I am using KeePassXC on my laptop, mobile and on my desktop. While I like that I have to re-enter the masterpassword on my laptop, or validate with my fingerprint on mobile, I find it super annoying that I have to re-enter the master-password on my desktop every day.

Is there a way to start KeePassXC with a bash script on boot and enter the password automatically?

I found a similar questione for KeePassX here but its from 2014 and I don't understand the answer.

  • This would be a tremendous Security risk if this was possible for most. I personally don't think it's a good idea and Offtopic really for Ubuntu. – EODCraft Staff Feb 13 at 7:10
  • @EODCraftStaff I agree with everything you said except the offtopicness – why wouldn’t using this software on Ubuntu be on-topic? – dessert Feb 13 at 7:11
  • Your wanting a feature for Keepass to be enabled by Ubuntu...Why don't you contact KeePass? – EODCraft Staff Feb 13 at 7:12
  • @EODCraftStaff I was hoping there is a general way in Ubuntu to start a program through bash script. I am not asking to build this as a feature into KeePass. However, I may have found the solution here: gist.github.com/dAnjou/b99f55de34b90246f381e71e3c8f9262. I just need to figure out how Keyring works. – Adam Feb 13 at 7:20
  • Looks like a good approach you found there. Please write out as an answer for the benefit of future users if you get it working. You should rather start Keepassx from a launcher in your autostart folder, or manually form a launcher that unlocks it automatically. For sure, that is still less secure than entering the password each time, but it is the freedom of the well informed user to make the balance between security and convenience. – vanadium Feb 13 at 9:12
2

You can give a password to KeePassXC through standard input on the command line with the option --pw-stdin. Thus, in a most simple way, you can automatically open a KeePassXC database with a command like:

echo <yourpassword> | keepassxc --pw-stdin <path-to-your-database>.kdbx

This compromises security quite seriously compared to entering the password on opening directly, because your password is stored unencrypted in a file on your system.

A more secure option is to use another password vault, such as Gnome Keyring (Source). Your password is stored in an unreadable form, and one needs to be logged in as your user to be able to open KeePassXC or read the password.

You will need to install libsecret-tools for this to work.

First you need to store the KeypassCX password in the Gnome keyring. You can do this with the "Passwords and Keys" tool or with the command:

secret-tool store --label="KeePass <database_name>" keepass <database_name>

Next to a label, you are providing an attribute (here we choose "keepass") and a value (you can use the name of your database () or another string that should not contain spaces).

After login, you can then launch and unlock KeepassXC with the command

secret-tool lookup keepass <database_name> | keepassxc --pw-stdin <path-to-your-database>.kbdx

Still, this option is significantly less secure than supplying the password yourself while using KeepPassXC, but the well informed user should have the freedom to make the balance between security and convenience.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.