3

I am using KeePassXC on my laptop, mobile and on my desktop. While I like that I have to re-enter the masterpassword on my laptop, or validate with my fingerprint on mobile, I find it super annoying that I have to re-enter the master-password on my desktop every day.

Is there a way to start KeePassXC with a bash script on boot and enter the password automatically?

I found a similar questione for KeePassX here but its from 2014 and I don't understand the answer.

7
  • This would be a tremendous Security risk if this was possible for most. I personally don't think it's a good idea and Offtopic really for Ubuntu. Feb 13 '20 at 7:10
  • @EODCraftStaff I agree with everything you said except the offtopicness – why wouldn’t using this software on Ubuntu be on-topic?
    – dessert
    Feb 13 '20 at 7:11
  • Your wanting a feature for Keepass to be enabled by Ubuntu...Why don't you contact KeePass? Feb 13 '20 at 7:12
  • @EODCraftStaff I was hoping there is a general way in Ubuntu to start a program through bash script. I am not asking to build this as a feature into KeePass. However, I may have found the solution here: gist.github.com/dAnjou/b99f55de34b90246f381e71e3c8f9262. I just need to figure out how Keyring works.
    – Adam
    Feb 13 '20 at 7:20
  • Looks like a good approach you found there. Please write out as an answer for the benefit of future users if you get it working. You should rather start Keepassx from a launcher in your autostart folder, or manually form a launcher that unlocks it automatically. For sure, that is still less secure than entering the password each time, but it is the freedom of the well informed user to make the balance between security and convenience.
    – vanadium
    Feb 13 '20 at 9:12
6

You can give a password to KeePassXC through standard input on the command line with the option --pw-stdin. Thus, in a most simple way, you can automatically open a KeePassXC database with a command like:

echo <yourpassword> | keepassxc --pw-stdin <path-to-your-database>.kdbx

This compromises security quite seriously compared to entering the password on opening directly, because your password is stored unencrypted in a file on your system.

A more secure option is to use another password vault, such as Gnome Keyring (Source). Your password is stored in an unreadable form, and one needs to be logged in as your user to be able to open KeePassXC or read the password.

You will need to install libsecret-tools for this to work.

First you need to store the KeePassXC password in the Gnome keyring. You can do this with the "Passwords and Keys" tool or with the command:

secret-tool store --label="KeePass <database_name>" keepass <database_name>

Next to a label, you are providing an attribute (here we choose "keepass") and a value (you can use the name of your database (<database_name>) or another string that should not contain spaces).

After login, you can then launch and unlock KeePassXC with the command

secret-tool lookup keepass <database_name> | keepassxc --pw-stdin <path-to-your-database>.kbdx

This option remains significantly less secure than supplying the password yourself while using KeepPassXC, but the well informed user should have the freedom to make the balance between security and convenience.

6
  • I'm having the same issue as a user who answer-commented. The command works in that it starts KeePassXC and unlocks it, but a prompt to enter the password appears in the terminal window and I never get the cursor back. I tried adding a & to the command, and I could then press Enter to get the cursor back, but is there a cleaner way? Mar 14 at 14:12
  • @OrganicMarble That sounds as if you use autologin. To avoid any password prompt from Gnome keyring, you may need to set the password of the login keyring to nothing. But then you are probably better of with the echo approach. Then, only your KeePassX password is exposed (to someone able to snoop into your files)
    – vanadium
    Mar 14 at 16:07
  • Thanks for your reply! I don't use autologin, and the prompt is from keepassxc specifically. Not from the keyring. It all works except the script hangs here wanting an entry. Mar 14 at 17:21
  • The prompt is Database password: Mar 14 at 17:38
  • Not sure what goes wrong. I use this approach now myself without issues. Could be a wrong reference to the password in secret-tool or a syntax error: without the pipe, keepassc indeed would expect the password from the keyboard in the terminal.
    – vanadium
    Mar 14 at 17:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.