Seahorse and the keyring (extras/seahorse.sh)

SYNOPSIS

wrenctl install seahorse                     install it (edits /etc/pam.d/login)
wrenctl remove seahorse                      take the login lines out and remove it
wrenctl manual seahorse                      print the manual steps below

seahorse            "Passwords and Keys": look at what is stored (or Super+d)

Programs that need to remember a secret for you, such as a login token for gh, store it in a keyring: an encrypted store that is unlocked with a password. This installs the GNOME keyring and Seahorse ("Passwords and Keys"), from Debian, and adds two lines to /etc/pam.d/login, so the keyring is unlocked with your login password when you log in on the console, and programs don't ask again. A copy of the file from before is kept as /etc/pam.d/login.wren.bak.

LIMITS

• Once unlocked, any program running as you can ask the keyring for its secrets.
• The keyring is only as strong as your login password.
• A mistake in /etc/pam.d/login can lock you out of console logins: check a login on another console before logging out.

MANUAL INSTALL

# The keyring, its PAM module, and Seahorse
sudo apt install --no-install-recommends seahorse gnome-keyring libpam-gnome-keyring

# A copy of the login settings, to put back if something goes wrong
sudo cp -a /etc/pam.d/login /etc/pam.d/login.wren.bak
# Unlock the keyring with your password at login: one line after the
# "@include common-auth" line, one after "@include common-session"
sudo sed -i '/^@include common-auth/a auth       optional   pam_gnome_keyring.so' /etc/pam.d/login
sudo sed -i '/^@include common-session/a session    optional   pam_gnome_keyring.so auto_start' /etc/pam.d/login
# Both lines must be there
sudo grep -n gnome_keyring /etc/pam.d/login

# Before you log out: press Ctrl+Alt+F2 and check you can still log in there.
# If you can't, put the old file back:
#   sudo cp /etc/pam.d/login.wren.bak /etc/pam.d/login

To undo:

# Take the two keyring lines out of the login settings
sudo sed -i '/pam_gnome_keyring\.so/d' /etc/pam.d/login
# Remove the keyring and Seahorse
sudo apt purge seahorse gnome-keyring libpam-gnome-keyring
sudo apt autoremove --purge