Bug 336955 - GPG KWallet regularly asks for password instead of once at login
Summary: GPG KWallet regularly asks for password instead of once at login
Status: REPORTED
Alias: None
Product: kwalletmanager
Classification: Applications
Component: general (show other bugs)
Version: 2.0
Platform: Fedora RPMs Linux
: NOR normal
Target Milestone: ---
Assignee: Valentin Rusu
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-07-02 03:16 UTC by Sudhir Khanger
Modified: 2023-03-05 13:32 UTC (History)
5 users (show)

See Also:
Latest Commit:
Version Fixed In:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sudhir Khanger 2014-07-02 03:16:10 UTC
GPG KWallet is suppose to ask for password once at the login. Even if KWallet closes gpg could open it up for user all without asking any password as gpg is always open.

On my Fedora 20 KDE box, KWallet constantly asks for password. I am not sure what triggers the request for password as password dialog is not very descriptive. I suspect Network Manager or Chrome are the two culprits here.


Here is an excerpt from Rusu's blog:
IMPORTANT NOTE: the passphrase dialog only shows once. Even if the wallet is closed after initial open, subsequent opening will occur silently during the same KDE session! That’s great news for those annoyed by the kwallet password prompt in the middle of the KDE session. http://www.rusu.info/wp/?p=248

Reproducible: Always

Steps to Reproduce:
1. Create a GPG backed KWallet
2. Login to system
3. use your system for example. You will be regularly asked for gpg passphrase
Actual Results:  
System regularly requests GPG passphrase

Expected Results:  
System should only request GPG paraphrase once at system login.

GPG key here is created by Kgpg for trying out this gpg backed Kwallet. Setup is completely default.
Comment 1 Valentin Rusu 2014-07-03 19:54:57 UTC
I suppose gpg-agent is not launched. Could you please install gpg-agent if not already present on your system, then execute this in your favorite terminal:

cat 'eval `gpg-agent --daemon`' > ~/.kde4/env/gpg-agent.sh
chmod +x ~/.kde4/env/gpg-agent.sh

Then log-off and log-on again. Can you confirm this fixes it?

And BTW, google-chrome integrates with kwallet, triggering kwallet password upon launch.
Comment 2 Sudhir Khanger 2014-07-04 18:01:21 UTC
As far as I can tell gpg-agent was already running. I didn't have .kde4 folder but I created one as recommended by you along with the file.

[donnie@fedora ~]$ ps aux | grep gpg-agent
donnie    1456  0.0  0.0 121376   824 ?        Ss   14:24   0:00 /usr/bin/gpg-agent -s --daemon --write-env-file /run/user/1000/.gpg-agent-info
donnie   30225  0.0  0.0 112676   920 pts/1    S+   23:30   0:00 grep --color=auto gpg-agent
[donnie@fedora ~]$ cat /run/user/1000/.gpg-agent-info
GPG_AGENT_INFO=/home/donnie/.gnupg/S.gpg-agent:1456:1

The result is that gpg key does ask for password several times in a session. NetworkManager will always ask for gpg-key password after resuming from suspend. Chrome tends to ask for gpg-key password whenever I am logging into any website.

If it matters I created this test gpg key using Kgpg. Kgpg didn't have "use gpg-agent" enabled initially which I have done now but no luck so far.
Comment 3 Sudhir Khanger 2014-07-07 17:19:58 UTC
Rusu,

Are you sure gpg keys remain unlocked for the whole session? I am no gpg guru but this caught my eye about gpg-agent.

--default-cache-ttl n
Set the time a cache entry is valid to n seconds. The default is 600 seconds.

That means passphrase cache will be removed every 10 minutes.
Comment 4 Sudhir Khanger 2014-07-07 17:28:31 UTC
Also see

--max-cache-ttl n
Set the maximum time a cache entry is valid to n seconds. After this time a cache entry will be expired even if it has been accessed recently or has been set using gpg-preset-passphrase. The default is 2 hours (7200 seconds).

Source: https://www.gnupg.org/documentation/manuals/gnupg/Agent-Options.html#Agent-Options
Comment 5 Valentin Rusu 2014-07-07 20:38:19 UTC
Ok, I see. However, is your system using these settings?
As on my system, which does not use these, I have no problems. The keys remain unlocked for the duration of the session.
Comment 6 Sudhir Khanger 2014-07-08 02:08:15 UTC
Unless your distribution is doing some magic I am not sure what it happening.

1. How have you created the GPG?
I used Kgpg.

2. How do you run gpg-agent?
Kgpg has use gpg-agent option which I enabled. It created a ~/.gnupg/gpg.conf with use-agent in the file.

3. If possible could you post output of following files:
~/.gnupg/gpg.conf
~/.gnupg/gpg-agent.conf

I might create a thread in Fedora and Arch forums to see what other folk's experiences are.

Thanks.
Comment 7 Mathieu Jobin 2015-09-14 17:26:23 UTC
Valentin, you also have a GPG backed kwallet? and you don't have this problem?

my situation seems very similar to Sudhir,

my gpg-agent is running. and chrome always trigger kwallet to ask for my GPG password
when using firefox, things remains silent ....

very annoying, as i dont even use kwallet for chrome, only for kmail and other kde apps

mathieu   2448  0.0  0.0 170804   928 ?        Ss   09:53   0:00 gpg-agent --homedir /home/mathieu/.gnupg --use-standard-socket --daemon

thanks
Comment 8 Justin Zobel 2021-03-10 00:32:39 UTC
Thank you for the bug report.

As this report hasn't seen any changes in 5 years or more, we ask if you can please confirm that the issue still persists.

If this bug is no longer persisting or relevant please change the status to resolved.
Comment 9 Balázs Róbert Börcsök 2023-03-05 13:32:24 UTC
(In reply to Justin Zobel from comment #8)
> Thank you for the bug report.
> 
> As this report hasn't seen any changes in 5 years or more, we ask if you can
> please confirm that the issue still persists.
> 
> If this bug is no longer persisting or relevant please change the status to
> resolved.

I can confirm this does exist.
Chromium triggers the OpenGPG prompt, but for instance the KDE Wallet manager or Firefox does not.