From be41e228fecc5f3f4d11e690dfe378b3cff0e607 Mon Sep 17 00:00:00 2001 From: David Kebler Date: Wed, 20 Dec 2023 17:24:54 -0800 Subject: [PATCH] keepassxc support for unlocking using dbus --- apps/keepassxc/keepassxc-ssh-unlock.sh | 14 ++ apps/keepassxc/keepassxc-unlock.sh | 16 ++ apps/keepassxc/keepassxc.inst | 20 +++ apps/keepassxc/readme.md | 208 +++++++++++++++++++++++++ 4 files changed, 258 insertions(+) create mode 100755 apps/keepassxc/keepassxc-ssh-unlock.sh create mode 100755 apps/keepassxc/keepassxc-unlock.sh create mode 100755 apps/keepassxc/keepassxc.inst create mode 100644 apps/keepassxc/readme.md diff --git a/apps/keepassxc/keepassxc-ssh-unlock.sh b/apps/keepassxc/keepassxc-ssh-unlock.sh new file mode 100755 index 0000000..1ca8a31 --- /dev/null +++ b/apps/keepassxc/keepassxc-ssh-unlock.sh @@ -0,0 +1,14 @@ +#!/bin/bash +_dir="$(dirname $(realpath "${BASH_SOURCE:-$0}"))" +if systemctl --user cat ssh-agent &> /dev/null ; then +echo starting user ssh-agent +systemctl --user restart ssh-agent +echo agent socket should be ssh-agent.sock not keyring +env | grep SSH_AUTH +echo sourcing ssh-agent properties at $HOME/ssh-agent.properties +cat $HOME/ssh-agent.properties +source $HOME/ssh-agent.properties +$_dir/keepassxc-unlock.sh "$@" +else +no ssh-agent service file for user $USER +fi diff --git a/apps/keepassxc/keepassxc-unlock.sh b/apps/keepassxc/keepassxc-unlock.sh new file mode 100755 index 0000000..4d36477 --- /dev/null +++ b/apps/keepassxc/keepassxc-unlock.sh @@ -0,0 +1,16 @@ +#!/bin/bash +# Get password using secret-tool and unlock keepassxc +# this currently only works for no password but key only unlock +database=${1:-$KEEPASS_DB_PATH} +keyfile=${2:-$KEEPASS_DB_KEY_PATH} +unlock="dbus-send --print-reply --dest=org.keepassxc.KeePassXC.MainWindow /keepassxc org.keepassxc.KeePassXC.MainWindow.openDatabase string:$database string:"" string:$keyfile" +if ! qdbus | grep keepassxc; then + keepassxc& + sleep 1 + if ! qdbus | grep keepassxc; then echo unable to start keepassxc; exit; fi +fi +if $unlock &> /dev/null; then + echo keepass database $database succesfully unlocked + else + echo unable to unlock $database +fi diff --git a/apps/keepassxc/keepassxc.inst b/apps/keepassxc/keepassxc.inst new file mode 100755 index 0000000..5dec769 --- /dev/null +++ b/apps/keepassxc/keepassxc.inst @@ -0,0 +1,20 @@ +#!/bin/bash +# https://grabski.me/posts/2020/09/automatically-unlock-keepassxc-on-startup-and-after-lock-screen/ +function keepassxc_install { + + local target + local dir="$(dirname $(realpath "${BASH_SOURCE:-$0}"))" + for script in $dir/*.sh; do + name=$(basename ${script%.sh}) + target="${1:-/opt/bin}/$name" + chmod +rx $script + ln -sf $script $target + echo link to $script created at $target + echo script $name in path at $(which $name) + done + + ls -la /opt/bin | grep keepass +} + +# if script was executed then call the function +(return 0 2>/dev/null) || keepassxc_install $@ \ No newline at end of file diff --git a/apps/keepassxc/readme.md b/apps/keepassxc/readme.md new file mode 100644 index 0000000..e86c55a --- /dev/null +++ b/apps/keepassxc/readme.md @@ -0,0 +1,208 @@ +--- +layout: post +title: Automatically unlock KeepassXC on startup and after lock screen +categories: tech linux +date: 2020-09-02T19:10:45.766Z +thumbnail: /assets/uploads/keepassxc-lock.png +url: https://grabski.me/posts/2020/09/automatically-unlock-keepassxc-on-startup-and-after-lock-screen/ +--- +I will be using Ubuntu 20.04 and KeepassXC 2.7.0 but this guide should work for any GNOME desktop. + +Note: From KeepassXC 2.7.0, developers [changed the dbus interface](https://github.com/keepassxreboot/keepassxc/pull/7523) so it's more consistent now. +I updated scripts accordingly. + +To securely store KeepassXC main database password we will use `secret-tool` from package `libsecret-tools`. Using this tool we make sure that we don't store our password for KeepassXC in plaintext somewhere in our system. + +To lock/unlock KeepassXC we will communicate through [d-bus](https://en.wikipedia.org/wiki/D-Bus). +For KDE it's necessary to modify the script slightly and use `qdbus` instead. + +There is CLI tool `keepassxc-cli` installed along with keepassxc but it works independently, so if we have opened db in keepassxc we cannot close it using keepassx-cli. + +OK, enough talking, let's do the job. + +## Install libsecret-tools + +Execute in terminal: +`$ apt install libsecret-tools` + +## Securely store KeepassXC database password + +Attention! Change angle brackets accordingly to your setup. + +Based on [this gist](https://gist.github.com/dAnjou/b99f55de34b90246f381e71e3c8f9262 "Automatically unlock KeePass database with GNOME Keyring") execute: + +``` +$secret-tool store --label="KeePass " keepass +``` + +## Lock database when session is locked or lid is closed + +It's easy to do in UI. + +![KeepassXC security settings](/assets/uploads/keepassxc-settings.png) + +Tools -> Settings -> Security -> Lock database when session is locked or lid is closed + + +## Create scripts for startup, lock/unlock of KeepassXC + +We will create a few scripts to easily do the job. All of the scripts has to be in environmental `$PATH` in my case it is `~/bin`. + +### keepassxc-unlock + +Attention! Change angle brackets ``, ``, `` accordingly. + +Content of `keepassxc-unlock` - script gets a db password from secret-tool and using d-bus we speak to keepassxc to unlock db. + +``` +#!/bin/bash +# Get password using secret-tool and unlock keepassxc +tmp_passwd=$(secret-tool lookup keepass ) +database='' +keyfile='' +dbus-send --print-reply --dest=org.keepassxc.KeePassXC.MainWindow /keepassxc org.keepassxc.KeePassXC.MainWindow.openDatabase \ +string:$database string:$tmp_passwd string:$keyfile +``` + +### keepassxc-lock + +Content of `keepassxc-lock` - we just send a message through d-bus to lock db. +``` +#!/bin/bash +dbus-send --print-reply --dest=org.keepassxc.KeePassXC.MainWindow /keepassxc org.keepassxc.KeePassXC.MainWindow.lockAllDatabases +``` + +### keepassxc-startup + +Content of `keepassxc-startup` - keepassxc has option to startup automatically, but we will take care of it on our own. Otherwise it might happen that we will try to unlock keepassxc before it's' up and running. + +``` +#!/bin/bash +keepassxc& +sleep 1 +keepassxc-unlock +``` + +### keepassxc-watch + +Content of `keepassxc-watch` - this script looks for d-bus message that the screensaver/session is unlocked, then we unlock password manager. + +``` +#!/bin/bash +# KeepassXC watch for logout and unlock a database + +dbus-monitor --session "type=signal,interface=org.gnome.ScreenSaver" | + while read MSG; do + LOCK_STAT=`echo $MSG | grep boolean | awk '{print $2}'` + if [[ "$LOCK_STAT" == "false" ]]; then + keepassxc-unlock + fi + done +``` + +All of the files needs to be executable, so in our scripts directory we do: +``` +chmod +x ./keepassxc-lock ./keepassxc-startup ./keepassxc-unlock ./keepassxc-watch +``` + +Now you should try to run the scripts and check if everything is working as supposed + +## Add scripts to startup + +We will add two of our scripts to run in startup: + +* `keepassxc-startup` - start up keepassxc and unlocks db +* `keepassxc-watch` - watch if we unlocked session, if so we unlock keepassxc + +There is two methods, by GUI, using `Startup Applications` or using terminal. + +Let's create two .desktop files in `~/.config/autostart` + +Content of `keepassxc-startup.desktop`: + +``` +[Desktop Entry] +Type=Application +Exec=/home/grabek/bin/keepassxc-startup +X-GNOME-Autostart-enabled=true +X-GNOME-Autostart-Delay=2 +Hidden=false +NoDisplay=false +Name=keepass +Comment[en_GB]=Lanuch unlocked keepass +Comment=Lanuch unlocked keepass +Name[en_GB]=keepassxc-startup +``` + +Content of `keepassxc-watch.desktop`: + +``` +[Desktop Entry] +Type=Application +Exec=/home/grabek/bin/keepassxc-watch +Hidden=false +NoDisplay=false +X-GNOME-Autostart-enabled=true +Name[en_GB]=keepassxc-watch +Name=KeepassXC watch for logout and unlock +Comment[en_GB]=KeepassXC watch for logout and unlock +Comment=KeepassXC watch for logout and unlock +``` + + +## Create a desktop launchers for more convenience + +We will also create two desktop launchers for easy lock/unlock KeepassXC in GNOME. + +Let's create two files in `~/.local/share/applications + +Content of `keepassxc-lock.desktop`: + +``` +[Desktop Entry] +Name=KeePassXC-lock +GenericName=Password Manager +Comment=Secure way to lock KeepassXC +Exec=keepassxc-lock +Icon=keepassxc +StartupNotify=false +Terminal=false +Type=Application +Version=1.0 +Categories=Utility;Security;Qt; +MimeType=application/x-keepass2; +``` + +Content of `keepassxc-unlock.desktop`: +``` +[Desktop Entry] +Name=KeePassXC-unlock +GenericName=Password Manager +Comment=Secure way to unlock KeepassXC +Exec=keepassxc-unlock +Icon=keepassxc +StartupNotify=false +Terminal=false +Type=Application +Version=1.0 +Categories=Utility;Security;Qt; +MimeType=application/x-keepass2; +``` + +From now on, we can just do `⊞ Win` and then starts typing lock or unlock + +![KeepassXC security settings](/assets/uploads/keepassxc-lock.png) + + +## Security concerns + +**In this solution we trade security for easiness and simplicity.** + +It's easy to get our password in plaintext while we are logged in, just type in terminal: `$ secret-tool lookup keepassxc passwords` - BAM! our super-secure password in plaintext. + +To delete our password stored in secret-tool we execute `secret-tool clear keepass ` + +You can see more records in GNOME keyring using [Seahorse](https://wiki.gnome.org/Apps/Seahorse). + + +Updated on 04.04.2022 \ No newline at end of file