7

I forgot the passphrase for my ssh private key, but it's still stored in gnome-keyring, so it seems to me that I should be able to recover it. Seahorse lets me recover web site passwords from my keyring, but I don't see a way to recover my ssh passphrase. Can someone tell me how to do this?

Improve this question

3 Answers 3

Reset to default
9

After some searching and a bit of arguing, two small python programs turned up that do exactly what I needed. Both were able to dump all the passwords that are stored by gnome-keyring, including my ssh key's passphrase. (This is secure, of course, because it only works once I have unlocked my keyring.) See these blog posts for the code:

https://blog.schmichael.com/2008/10/30/listing-all-passwords-stored-in-gnome-keyring/

https://ins3cure.blogspot.fr/2012/07/extracting-gnome-keyring-credentials.html

Thank you, Michael Schurter and Liviu. I can now simply update my passphrase instead of going through the trouble of replacing my old ssh key on every system where it is installed.

Improve this answer
3
  • 2
    I think this must have changed with later versions. With Gnome 3.10, the first script only enumerates my Login keys (which "Passwords and Keys" list separately from SSH). I'm still looking for a way to recover an SSH password now.
    – IBBoard
    Dec 5, 2013 at 20:17
  • 2
    Those scripts no longer work on new distros
    – PeterM
    Oct 26, 2017 at 11:10
  • 1
    Life saver. The scripts work just fine for me on Ubuntu 16.04. Don't forget to install python-gnomekeyring and run as python2.
    – Nicholi
    Jan 16, 2018 at 1:23
1

You can use Python and secretstorage

import secretstorage

conn = secretstorage.dbus_init()
collection = secretstorage.get_default_collection(conn)
print(collection.is_locked())
collection.unlock()
for item in collection.get_all_items():
    print(item.get_label())
    print(item.get_attributes())
    print(item.get_secret())
    print("-" * 80)
Improve this answer
-4

If gnome-keyring works just like ssh-agent, you don't. The passphrase cannot be recovered once it is forgotten. It is used to encrypt the private key and if you forget it... well that's it.

If it is indeed stored internally, then that's another issue.

Improve this answer
5
  • 2
    I get the impression that you didn't understood my post. A keyring manager would not work at all if it couldn't recall the passwords stored in it.
    – ʇsәɹoɈ
    Oct 3, 2012 at 8:12
  • passPHRASE is not the same as passWORD when you are working with ssh. PassPHRASES are used to encrypt a private encryption key. PassWORDS are used in lieu of key-based authentication. Which are you looking for? PassWORDS or passPHRASES?
    – UtahJarhead
    Oct 3, 2012 at 12:14
  • If they're stored at all, something like this will extract it. ins3cure.blogspot.fr/2012/07/… The jury is out if ssh passPHRASES are even stored at all, vs cached in memory. I can't find anything specific. However, if gnome-keyring works like ssh-agent does, then the passphrase is cached in memory and not stored to disk meaning recovery would not be possible.
    – UtahJarhead
    Oct 3, 2012 at 12:42
  • Are you telling us that you have stored your passphrase in your gnome-keyring, similarly to gentoo-wiki.info/… ?
    – Yedric
    Oct 3, 2012 at 14:36
  • 2
    Yedric, yes, my ssh key passphrase is stored my gnome-keyring. (I thought I made that clear in my first sentence.) Upon login, gnome-keyring uses my login password to unlock (decrypt) its own storage, which includes what it needs to automatically load my ssh key without prompting me for a passphrase. In order to do this, it must be able to retrieve either my ssh passphrase or an unencrypted copy of my ssh key from storage once it has my login password. This works, and I know my login password, so there must be a way for me to retrieve that same data. That is my goal.
    – ʇsәɹoɈ
    Oct 3, 2012 at 17:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .