I am running debian 10, xfce, gnome-keyring, ssh-agent, LUKS partition.
The reason why I use gnome-keyring is because I don't want to enter ssh key passphrase once upon a reboot. And this is because there are many CCTV cameras around. I am afraid if some kinda secret CCTV camera records what I typed. I always avoid entering passwords and trying to enter as less time as possible.
With the current setup, I need to enter two passwords at least. One for LUKS partition and one for system login in lightdm.
Today, I am thinking to reduce one password requirement and make the system autologin, so no need to enter system user login password anymore. I think this is still in the same security level as before because LUKS parittion encryption is still there. (OR less secure, but still secure with LUKS)
Once I enable autologin, I find out the gnome keyring is no longer unlocked automatically anymore. If I want to unlock it with my current setup, I have to enter unlock password again, that is the second password I want to avoid.
By goolging, I find out I can simply remove the unlock password from gnome keyring in seahorse so make it unlock with autologin.
The above is the detail story of my current situation. So here is the question. I don't know what will really happen in the background if I remove the unlock password from gnome keyring.
The reason why I used gnome keyring is because I don't want any running programs in my system can access the ssh private key directly from the file system ~/.ssh/id_rsa
. Some people may argue that programs may still get the keys from memory. I don't really care how that works as long as this improves some kind of security. I am OK as long as the unencrypted ssh-key is not stored in the file system somewhere. I am afraid removing password from gnome-keyring will make unecnrypted files stored in file system in a plain text format. Will removing password from gnome keyring make any difference on the storage (file system) point of view?
I don't really care there is no password to unlock the keyring, because I have LUKS partition encryption and people can not use the keyring unless they know my LUKS password. But I do care if any running programs can access some plain text keys directly from file system if I remove the keyring password.
I hope I have made myself clear in this question and thank you very much for your help.