Skip to content

Instantly share code, notes, and snippets.

# vorstrelok / keepassxc_pam.fish

Created Feb 2, 2021

- Star 3
- Fork 0

Star
KeePassXC PAM loing manager integration
Raw
keepassxc_pam.fish
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters

| #!/usr/bin/fish --private
| # !!!Security note!!!
| # This will give any process running as your user access to your password while
| # key has not expired (2 minutes or revocation by service, whatever comes first)
| # Proper solution would probably be writing PAM module and transfering key
| # straight to KeePassXC's own keyring
| set userid (/usr/bin/id -u "$PAM_USER")
| if test "$PAM_TYPE" = 'auth'
| if keyctl show %:_uid.$userid
| # reap just in case something went wrong and key expired by timeout
| /usr/bin/keyctl reap
| /usr/bin/keyctl padd user keepassxc:password %:_uid.$userid | read keynumber
| else
| /usr/bin/keyctl padd user keepassxc:password @u | read keynumber
| # give root permission to access key
| /usr/bin/keyctl setperm $keynumber 0x3f190000
| end
| /usr/bin/keyctl timeout $keynumber 120
| else if test "$PAM_TYPE" = 'open_session'
| /usr/bin/keyctl move -f %user:keepassxc:password %keyring:_uid.0 %keyring:_uid.$userid
| else
| exit 1
| end

Raw
keepassxc_sendpass.fish
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters

| #!/usr/bin/env fish
| keyctl watch @u | while read from type key
| if test $key -eq (keyctl id %user:keepassxc:password)
| for i in (seq 30)
| if dbus-send --print-reply --dest=org.keepassxc.KeePassXC.MainWindow /keepassxc org.keepassxc.MainWindow.openDatabase string:Documents/Passwords.kdbx string:(keyctl print $key)
| keyctl revoke $key
| break
| end
| sleep 1
| end
| end
| end

Raw
keepassxc_sso.service
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters

| [Unit]
| Description=KeePassXC password input
| [Service]
| ExecStart=/home/vorstrel/keepassxc_sendpass.fish
| [Install]
| WantedBy=default.target

Raw
system-local-login
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters

| #%PAM-1.0
| auth include system-login
| auth optional pam_exec.so expose_authtok /home/vorstrel/keepassxc_pam.fish
| account include system-login
| password include system-login
| session include system-login
| session optional pam_exec.so /home/vorstrel/keepassxc_pam.fish

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.