PAM_KEYRING: Automatic Keyring Authentication
Posted by gmendoza on June 21, 2007 under Tech Tips | 
24 Comments to Read
WARNING! THIS POST HAS BEEN MARKED AS OUTDATED!
While there may be useful information still contained within the article, there may be other more relevant articles out on the Internet. Please pay close attention to version numbers of software that this article refers to. If you're not careful, you could break your system if you do not understand what you are doing. If you would like to see this article updated, please contact the site administrator using the Contact page. Thanks!
UPDATE (11-03-2008): These instructions are no longer applicable to Ubuntu version 8.10 and higher. The latest versions of Ubuntu allow you to use a blank password for your keyring, which will allow user accounts automatically logged in by GDM to access the keyring.
If you are not using the the GDM auto login feature, simply make sure your keyring password is the same as your login password, this way it is automatically unlocked for you. The keyring passwords are now easy to change from “Applications… Accessories… Passwords and Encryption Keys… Edit menu… Preferences… Password Keyrings.” Highlight the “login” entry, and use the “Change Unlock Password” button.
The original instructions below ONLY apply to versions previous to Ubuntu 8.04.
ORIGINAL POST:
If you would like to avoid having to type in a password to access your gnome keyring, then you are in luck. To quote from the authors web site, “PAM_KEYRING is a pam module that launches the gnome-keyring-daemon and then unlocks a keyring using your login password.”
In Ubuntu 7.04, this comes in handy when using Network Manager to connect to your wireless network. Typically users are prompted for the “master” password to their keyring manager immediately after logging on to gnome, and this can become tedious. Installing and configuring PAM_KEYRING is a snap.
1. Install libpam-keyring from universe repositories.
$ sudo apt-get install libpam-keyring
2. Add the pamkeyring module to /etc/pam.d/gdm
$ echo "@include common-pamkeyring" | sudo tee -a /etc/pam.d/gdm
UPDATED: (10/25/2007)
With the release of Ubuntu 7.10 Gutsy, libpam-keyring is no longer needed, as this feature has been built by default in with the package “libpam-gnome-keyring”.
UPDATED: (04/21/2008) – For GDM Auto-Login Users
Sorry for not updating this post sooner. I helped someone else with this offline a while back. Here’s an excerpt from my email. It works well with Ubuntu 7.10 Gutsy, and “should” work with Hardy, unless there’s been some major changes with the libpam-gnome-keyring package that I don’t know about.
The auto login feature of GDM relies on the GDM processes ability to run Gnome as your user account, but it does not have to know the password, as it’s using an “su” command to accomplish the magic.
There lies the problem. The keyring uses the password supplied by the user to unlock itself, and being that no password is supplied to pam, it cannot unlock the keyring.
From a useful bug report, one fellow outlined how he has always done it previously using a login script. He used a tool called “pam-keyring-tool” included with the libpam-keyring package. The new libpam-gnome-keyring package does not include this binary, so in order for this to work, you need compile it from source.
I’ve successfully got it working using the following procedures:
Step 1: Download latest pam_keyring source code. I like to place all source code in /usr/src/:
cd /usr/src/
sudo wget http://www.hekanetworks.com/opensource/pam_keyring/pam_keyring-0.0.9.tar.gz
Step 2: Unpack source code
sudo tar zxfv pam_keyring-0.0.9.tar.gz
Step 3: Install prerequisites
sudo apt-get install build-essential libglib1.2-dev libglib2.0-dev
sudo apt-get install libtool libgnome-keyring-dev libpam0g-dev
Step 4: Compile and Install
cd /usr/src/pam_keyring-0.0.9
sudo ./configure --prefix=/usr
sudo make
sudo cp src/pam-keyring-tool /usr/bin/
Note: I’m not doing a “make install” because I only want this binary to be installed and nothing else)
Step 5: Test binary
/usr/bin/pam-keyring-tool --help
If you get a nice usage menu, you’ll see what the tool options are, and your compilation is complete.
Step 6: Create login script called “unlock-keyring.sh”.
Since the file will contain your password in clear text, you’ll want to keep it in your home folder, readable only by your user. Yes… I know this is lame.
mkdir ~/scripts
sudo chmod 750 ~/scripts
touch ~/scripts/unlock-keyring.sh
sudo chmod 750 ~/scripts/unlock-keyring.sh
sudo gedit ~/scripts/unlock-keyring.sh
Add the following to the script:
#!/bin/bash
echo "PASSWORD_HERE" | /usr/bin/pam-keyring-tool -u -s
Step 7: Add the script to your gnome session startup scripts
System -> Preferences -> Sessions
Under Startup Programs, add a new entry that will appear first in the list. e.g. “1-unlock-keyring”
The command will be:
“/home/USERNAME_HERE/scripts/unlock-keyring.sh”
Step 8: Ensure your /etc/pam.d/gdm-autologin is set to it’s defaults. This was the default Gutsy 7.10 version for reference.
#%PAM-1.0
auth requisite pam_nologin.so
auth required pam_env.so readenv=1
auth required pam_env.so readenv=1 envfile=/etc/default/locale
auth required pam_permit.so
@include common-account
session required pam_limits.so
@include common-session
@include common-password
Step 9: Restart GDM or simply reboot.
I really hope this helps you guys out.
