0

On my Ubuntu (17.04) desktop, GNOME keyring (GK) aka "Seahorse" has my SSH private key (~/.ssh/id_rsa) loaded in. The key is protected by a password and GK prompts me for a password to unlock it after logging out of my session (eg: after rebooting my box).

So far so good but in order to improve security, I'd rather get prompts a little more often, eg: after the computer unlocked, which would also catch resuming from sleep/hibernation. This might help mitigate attacks against a laptop stolen while suspended.

Is there a way to achieve this? A time-based setting similar to ssh-add -t <duration> would also work.

Bonus: I have to say I don't fully understand the relationship between GK and ssh-agent (despite trying to parse available documentation). Considerations on whether using GK in this scenario is a serious security risk also welcome. Cheers!

1 Answer 1

0

Is there a way to achieve this? A time-based setting similar to ssh-add -t <duration> would also work.

No. It is not possible to do that using gnome-keyring. It has a ssh-store, which picks up the default SSH identities and unlocks them on the first use. There is no way to get them "locked" again on the event of locking screen.

Bonus: I have to say I don't fully understand the relationship between GK and ssh-agent (despite trying to parse available documentation). Considerations on whether using GK in this scenario is a serious security risk also welcome.

The gnome-keyring is just implementing ssh-agent interface. The gnome-keyring is application written to be secure the same way as the ssh-agent is. It has just a limited functionality.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .