44

When you have a LUKS encrypted drive in your computer, Nautilus or Nemo will show it under Devices as a drive with a little lock on it.

When you click it, you need to enter a password. If you choose to remember this password forever, it gets saved to your keyring. Next boot, clicking on the drive will immediately mount it.

How do I 'immediately mount' such a drive for which the passphrase is stored in the keyring, from the terminal? I want to have an autostart script that will mount my LUKS drive when I log in. I do not want to store my passphrase in the script, I want to use the passphrase from the keyring:

If you go to Passwords And Keys, there's a bunch of nameless keys. In their properties you can find a description like gvfs-luks-uuid=xxxxxxxxxxxx and also the password for that LUKS drive. This is what Ubuntu uses.

One option I thought about is python-gnomekeyring but it can only get the keyname and password. I need what the GUI calls 'Technical Details' to get the password for a specific uuid because the keyname is always empty.

3 Answers 3

44

You can use secret-tools to store and retrieve the password from the keyring.

To store a new password:

secret-tool store --label='Password for mydrive' drive mydrive

I let you check in the keyring how it appears. To look it up (this command can easily be inserted in your script):

secret-tool lookup drive mydrive
5
  • Note that the secret to secret-tool is that you cannot be root to work the examples!
    – Paul Flint
    May 26, 2017 at 11:16
  • 2
    Isnt secret-tools a key-value tool? Seeing that the --label option is mandatory, why do I need three keys for one value? I just saved my value like this: secret-tool store --label=my_key my_key my_key and it works, but this is super weird
    – phil294
    Jun 17, 2020 at 19:12
  • @phil294 The so-called "attribute" (key) and "value" are not arbitrary. Please RTFM.
    – xebeche
    Aug 9, 2020 at 16:19
  • 1
    @phil294 This page explains it: Intro to Gnome Keyring Keyrings -- "The data inside a keyring is stored in "items". Each item has a name, such as "university proxy password" or "example.org SSH private key password", a secret, and an unlimited list of attributes. Each attribute consists of a name-value pair that is intended to serve as a hint for the applications (e.g., "user=fer", or "server=example.org"). This enables applications to find the relevant item in the keyring. All strings are UTF-8."
    – wjandrea
    Mar 20, 2021 at 23:03
  • @xebeche I RTM but it does not explain what the attributes and values are. It doesn't even have a "See also" page or any useful info for learning more. However, I found the info independently. See my comment above.
    – wjandrea
    Mar 20, 2021 at 23:05
10

I think the only answer is through python, but there are two bugs that make things hard.

  1. You need to manually give your keys names (Seahorse: Descriptions) because identifying details that other applications use are not available in the python version. I have created a bug report here: https://bugs.launchpad.net/ubuntu/+source/gnome-python-desktop/+bug/1144781
  2. These descriptions are empty in Seahorse in the specific case of LUKS keys, but changing the empty description does actually change the key name so you can look for it in python. I have created a bug report here: https://bugs.launchpad.net/ubuntu/+source/seahorse/+bug/1144703

If you are working with scripts and keyrings, please mention that these bugs affect you too.

As for the python part, here is an example:

#!/usr/bin/env python

import gnomekeyring as gk

keyring = 'login'
keyItems = gk.list_item_ids_sync(keyring)

for keyItem in keyItems:
    key = gk.item_get_info_sync(keyring, keyItem)
    if  key.get_display_name() == 'KeyName you are looking for':
        # Your script here using key.get_secret()
        print "Password:", key.get_secret()

If you know of any other way, e.g. through simple bash commands, please let us know.

2
8

Use Python Keyring Lib

It has a convenient CLI for use in shell scripts.

Installation

pip install keyring

Setting and getting keys

$ keyring set system username
Password for 'username' in 'system':
$ keyring get system username
password

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.