4 ms·
A really annoying aspect of keyrings in Linux is that if you are writing a generic Linux service (runs in the background, should support all distributions), the
by ayende 5y ago
A really annoying aspect of keyrings in Linux is that if you are writing a generic Linux service (runs in the background, should support all distributions), there is no real option without 3rd party components.
On Windows, there is the Data Protection API, which allows you to encrypt a secret tied to a user's login or a machine's key. That is managed by the OS and allows you to lean on the built-in facilities.
- paulfurtado 5y agoAre you aware of the kernel keyring and the keyctl API? I've always been curious why more programs don't use it, I guess it's not the most ergonomic API and doesn't have many language bindings. https://man7.org/linux/man-pages/man2/keyctl.2.html https://man7.org/linux/man-pages/man2/keyctl.2.html
- toyg 5y agoI considered it but, iirc, it's Linux-specific and I wanted something that could run on BSDs too.
- tremon 5y agoThat's nice, but you're moving the OP's goalposts here. The OP only mentioned Linux.
- GoblinSlayer 5y agoThat's a big manpage, but it tells nothing about what it is and does, you already need to know everything about it, but only want to refresh details.
- danuker 5y agoProbably the kernel keyring one is a better intro: https://man7.org/linux/man-pages/man7/keyrings.7.html https://man7.org/linux/man-pages/man7/keyrings.7.html
- hawski 5y agoAFAIU from the post itself it seems the main problem is, that the kernel keyring API doesn't implement persistence, so it can be used to implement high level key-rings, but it is not enough by itself.
- Nextgrid 5y agoSomeone above mentioned systemd-creds: https://www.freedesktop.org/software/systemd/man/systemd-creds.html# https://www.freedesktop.org/software/systemd/man/systemd-cre...
- krageon 5y agosystemd is not linux.
- RobertMiller 5y agoNeither is your shell. You may as well complain that there is no way to use Linux at all without some form of 3rd party software one way or the other. It's a silly complaint; this is why distros exist.
- yrro 5y agoA requirement I'd like to see for such a Linux service would be to not rely on the user's password. When my users change their AD password, they have a nasty time unlocking their GNOME keyring...
- sp1rit 5y agoWhat alternative to a users passwords do you have in mind? The only other potential cryptographically secure alternative might be a TPM chip, if a machine has this. However since a TPM stores secrets system wide, keyrings for each user seam unfeasible and it's likely less secure since you could just boot into single user mode and get the TPM secrets. Additionally I tend to not trust the TPM (esp. on Linux), because if one firmware update somehow fails to apply properly, I'll have a far more nastier time (since all secrets are gone) than GNOME Shell promoting me to insert my old password.
- yrro 5y agoI really don't know, to be honest. TPM is one option. They should be pretty reliable--if not then you'd have Windows users kissing their encrypted disks goodbye, right? Another option (in my case) would be using FreeIPA's vault service to stash the key. It would be pretty easy for malware to grab the key though. Perhaps some setup where both a key owned by the user and a key owned by the host, with access mediated by sssd could be designed... (And admittedly for AD users it's no good since they can't use the vault service...) It feels like AD is missing some kind of secret storage service for users to make use of.
- WhyNotHugo 5y agoIt's also annoying on single user laptos, where I type a disk decryption password at startup, but then the have autologin set up (since it's pointless to prompt for a user password at that point).
- richardwhiuk 5y agoWhat's a third party component in this context?