| Pete Zaitcev ( @ 2008-10-05 14:03:00 |
| Entry tags: | fedora, gnome, linux |
The crazy keyring thing
Recent Rawhide (F10 Alpha and Beta) has one of the oddest features ever (Gnome Power Manager level of "odd" here). Whenever one runs ssh (including scp) for the first time, a dialog pops up, asking for a "password to unlock keyring".
Entering any kind of password fails: the dialog reappears again. I must click "Deny" to proceed. V.odd.
It's a little scary to realize that someone well-meaning interposed some pretty big chunk of [currently broken] software into something as fundamental as ssh. Who knows what else it does aside from contacting my X.
P.S. This can be disabled, right? Right?
UPDATE: Peter Robinson e-mailed that the missing package is seahorse. Also, there's apparently a stuck ~/.gnome2/keyring/login.keyring. Removing that gets it regenerated and functional, so gnome-keyring-manager can be used.
In case anyone is curious, GNOME hooks ssh by setting SSH_AUTH_SOCK to something like /tmp/keyring-HIZ5We/ssh. The socket is created by gnome-keyring. Apparently, ssh hooking cannot be disabled selectively.
I wrote before that it would be great if GNOME provided a central persistent keyring for applications such as Pidgin (which otherwise stores your Gmail password in plaintext). Unfortunately, they began with hooking OpenSSH, which has its own secure key management already, and left Pidgin out -- where this kind of capability would actually be useful.
UPDATE LATER: Ka-Hing Cheung wrote me that a plugin for Pidgin to use gnome-keyring exists. It was written under the auspices of Google Summer of Code, and is likely to be merged in a couple of releases.