KDE Wallet

From ArchWiki
Revision as of 16:35, 9 December 2017 by T.ask (talk | contribs) (Add troubleshooting section)
Jump to navigation Jump to search

KDE Wallet Manager is a tool to manage the passwords on your KDE Plasma system. By using the KWallet subsystem it not only allows you to keep your own secrets but also to access and manage the passwords of every application that integrates with KWallet.

Unlock KDE Wallet automatically on login

If your KWallet password is the same as your username password, you can unlock your wallet automatically on login.

Install kwallet-pam package. Then, if you are not using SDDM, edit your login manager pam file and add the lines under their corresponding sections:

auth            optional        pam_kwallet5.so
session         optional        pam_kwallet5.so auto_start

For LightDM, for example, edit /etc/pam.d/lightdm and /etc/pam.d/lightdm-greeter files:

auth            include         system-login
auth            optional        pam_kwallet5.so

account         include         system-login

password        include         system-login

session         include         system-login
session         optional        pam_kwallet5.so auto_start

For GDM, edit /etc/pam.d/gdm-password accordingly.

After restarting your wallet should unlock automatically if your user password is the same as your KWallet password.

Note: Currently, kwallet-pam has at least two limitations: first, it's not compatible with GnuPG keys, so KDE Wallet must use the standard blowfish encryption. Also, the wallet name must be "kdewallet" (that's the default name). If, for some reason, you create a new wallet, you need to use this name (so you will probably need to rename the old wallet too).

Using the KDE Wallet to store ssh key passhprases

First, make sure that you have an SSH agent running.

Install the ksshaskpass package.

Create an autostart file and mark it executable with chmod:

ssh-add </dev/null

Tango-go-next.pngThis article or section is a candidate for moving to KDE#Autostarting applications.Tango-go-next.png

Notes: General autostarting instructions belong there (Discuss in Talk:KDE Wallet#)
Tip: The above ssh-add.sh script will only add the default key ~/.ssh/id_rsa. Assuming you have different SSH keys named key1, key2, key3 in ~/.ssh/, you may add them automatically on login by changing the above script to:
ssh-add $HOME/.ssh/key1 $HOME/.ssh/key2 $HOME/.ssh/key3 </dev/null

You also have to set the SSH_ASKPASS environment variable, see Environment variables#Defining variables. E.g.:

export SSH_ASKPASS="/usr/bin/ksshaskpass"

It will ask for your password and unlock your SSH keys. Upon restart your SSH keys should be unlocked once you give your kwallet password.

To add a new key and store the password with kwallet use the following command

$ ssh-add /path/to/new/key </dev/null

and append the key to the list of keys in ~/.config/autostart-scripts/ssh-add.sh as explained above to have it unlocked upon providing the kwallet password.

KDE Wallet for Firefox

There is an addon to make Firefox store passwords with KDE5 Wallet.

Note: As of Firefox 57 this addon is not supported anymore. Make sure to set up a masterpassword in order to get a basic protection for your stored passwords.

KDE Wallet for Chrome and Chromium

Chrome/Chromium has built in wallet integration. To enable it, run Chromium with the --password-store=kwallet or --password-store=detect argument. To make the change persistent, see Chromium/Tips and tricks#Making flags persistent. (Setting CHROMIUM_USER_FLAGS will not work.)


KWalletManager won't run

Review the configuration in

System Settings > Account Details > KDE Wallet

See also