SSH - Minimal GUI-less keyring suggestions

Security

I've used Ubuntu and have enjoyed the luxury of the gnome keyring prompting me for my user password instead of my ssh key passphrase.

Then about a year back, I switched to Arch with KDE Plasma, and I enjoyed the same luxury with kwallet.

Now, I've ditched the majority of KDE Plasma (don't ask why the uninstall was so messy...) in favor of sway and a very minimal riced setup with as little GUI as possible. As I mangled my KDE Plasma packages during the KDE removal process, I've done something to make kwalletd6 not start up on boot. PAM something? Don't know, I don't know anything about PAM or D-Bus yet... Everything still works as intended, I just need to launch kwalletd6 before I try sshing anywhere.

But this leaves me at an impasse. I don't "love" the GUI pop-up when I ssh, and I don't use my wallet for anything else. I'd like to get back to a state where I can just use my user password to input the various passphrases for all of my various ssh keys. To get back to a state like that, I could do one of the following:

Get kwalletd6 to start when requested once again. This isn't my favorite solution, because I've actually soured on the KDE Plasma environment a bit. I love the idea of completely getting away from KDE. But that doesn't mean I want to run right into the arms of GTK with a seahorse-like solution.
Make a custom PAM solution. I see on the Arch wiki page for pam_ssh that you can do some fancy PAM things to add ssh keys to the ssh agent, but that wiki page does have a pretty scary "if you screw this up you'll need to recover your Arch from a backup CD" warning. Although I'd think you could just boot on a USB and fix the file without having to boot into the broken arch OS? Right? Anyway, beyond this scary warning, this also still involves messing with an etc file that would mess things up if I didn't have the pam_ssh module installed anymore. I'd want to couple this custom pam_ssh file to the pam_ssh AUR installation so that if I ever uninstall the pam_ssh package it would also remove my custom pam file.
A custom script that works with an encrypted file containing my passphrases. I'm thinking a gpg-encrypted file that encrypts the file with my user password. I could set up the SSH_ASKPASS environment variable to point to a bash script that, upon first invocation, decrypts the passphrases file and loads them into ssh-agent. First of all, I'm not actually sure this route would work. Second of all, if I leave the passphrases on my computer and encrypt those passphrases with a different passphrase, have I actually done anything more than just locking my ssh keys with my user password? I guess I could leave this encrypted file in one of my separate luks encrypted partitions... maybe that means this would be a better route? Lastly, it sounds like if I go with this option, I'm basically just handrolling my own password manager. That could be a bad thing since I'm not a security expert, but it could also be a good thing because it would be a very simple/uncomplicated solution that relies almost entirely just on reliable/ubiquitous programs such as ssh-agent and gpg. I like this option because there would be no added software packages. Just a simple script and an ecrypted file.

I know programs like KeePass exist, but I don't know if I want yet another password manager.

So what do we think? Am I crazy person? Am I missing a really obvious solution?

EDIT (Result): I ended up going with GNOME Keyring. It wasn't as minimalistic of a solution as I wanted and it did make me feel like I was taking one foot out of a KDE ecosystem and putting one foot in GNOME (which I wanted to avoid). But it was so easy; everything worked great out of the box. It was also a pretty minimal installation dependency-wise unlike many KDE components. It does have a GUI prompt rather than a terminal prompt, but maybe that's something I could figure out how to tweak one day. Lastly, while it is more feature rich than I was hoping for... I kinda like the features... Thanks to everyone for the discussion!

Oh, and for anyone stumbling on this in the future, I think I was on the wrong track with pam_ssh. The more I dug into it, it seemed less like a way to unlock keys to be used to ssh into other machines and more for unlocking authentication features if you were sshing into this machine. I could be wrong though! Still happy to discuss in the comments

in linuxby No-Razzmatazz2552

58%

View all comments

sidusnare

Well, why not? What are your requirements? I don't quite follow your original post. ssh-agent should be all you need for ssh.

No-Razzmatazz2552

I want a program (much like kwallet) that automatically loads my key into ssh-agent when I try to use it. When it would normally prompt me for my key passphrase, I instead want to be promoted for my user password.

Could I just set all of my ssh keys to use my user password as their passphrase? Yes; but less secure than having unique passwords for each key. Could I just not use passphrases on my keys? Yes; but less secure because my keys will not be encrypted at rest.

As for why I want something different than kwallet, those details are in my post.

sidusnare

So, just add your encrypted keys to the agent when you login, and don't worry about it again. Make sure you use KDF on your keys.

No-Razzmatazz2552

If you read my response to your comment or my original post, you'll see one of my basic requirements is that I don't have to provide my unique ssh key passphrases. Instead, I want to only have to provide my user password. So once again... ssh-agent will not work on its own.

Trust me, I use ssh-agent all the time and I've used it for years. I understand what it can and cannot do. And if you read the original post, you'll notice every single one of my suggested solutions does involve using ssh-agent. But each suggestion involves using something in addition to ssh-agent (kwallet, ssh_pam, and a bash script)

sidusnare

I don't understand your need for extra steps, why are you trying to add an intermediate password? What does that serve except to add more failure points?