Secure Password Storage Example #67
Conversation
… storage if the module and a suitable implementation is available when Nagstamon is ran.
…ers. Changed naming convention to match other python apps (like Mercurial).
Secure Password Storage Example
|
Using your changes in a GNOME3 environment from command line I get a command line prompt to create a new keyring password. Do you know more about how to use existing keyring technologies? |
|
Regarding the python-keyring web pages I try: |
|
I'm using Ubuntu 13.10 Desktop (x86_64). I had installed the Python keyring service using the python-keyring system package. This was all that was required to get this configured and working with the native Gnome keyring manager (Seahorse in Ubuntu 13.10). The basic premise of the system keyring is that credentials are securely stored in encrypted form with the key being derived from a password entered by the user. This is most useful when your login password is automatically used as the password which is what many Linux distros (& Windows) offer. We don't want to get into the realms of keyring config as the software should simply use what the OS offers. However, it may be necessary to tweak the keyring detection if it is not picking up that a system keyring service is not available. Would you be able to test in a virtual machine? A fresh install of Ubuntu 13.10 would mirror my set-up and all you should need to do is install the keyring package mentioned above. |
|
Yes, it should stay as simple as possible. I also did not check all options of python-keyring. Their website looks pretty promising. |
|
I tried on a fresh Ubuntu 13.10 and get this: henri@ubuntu1310:~/Schreibtisch/Nagstamon-master/Nagstamon$ ./nagstamon.py I am investigating, but anyway - do you have any idea what this means or what other preconditions have to be met? |
|
It was working pretty much OOB for me. Default install of Ubuntu 13.10. Make sure the user account has a password. Login to your X11 desktop. Check seahorse is present as application and loads OK. Installed keyring package with "sudo apt-get install -y python-keyring" That was pretty much all I needed to run Nagstamon. If you still have issues I could see about setting up a Vagrantfile to provision a test environment if you have Vagrant available? |
|
python-keyring was already installed. Googling the error message I found https://bugs.launchpad.net/backintime/+bug/1241979 - seems to be a bug in python-secretstorage. Do you have python-secretstorage installed? Uninstalling it is the workaround suggested there. |
|
Removing python-secretstorage I am at least able to start nagstamon.py. Now it crashes due to some GUI stuff... looks like some other problem, not keyring-related. |
|
Good that it's working for you now. I do have version 1.0.0-1 of python-secretstorage installed on my system and have no issues. |
|
Now it kind of runs... raised some GUI bug but this is another issue. I get this line again on command line: Please set a password for your new keyring: Maybe this would look differently if run only GUI-wise. How it should behave? Or, how do you run it? From commandline? |
|
Running the 0install unstable without command line also does not show up any keyring dialog. :-( |
|
Just one idea... what other somehow keyring-related packages do you have installed? |
|
I've uploaded a VM image (OVA format) with a working system keyring. This is a install of Ubuntu 13.10 (64 bit) with default options. The description field contains details of the steps I took to get it setup (only about 5). You can download from: http://www.campbellsoftware.co.uk/downloads/NagstamonTest.ova Please give this a try. |
|
OK I run it. The steps you did where the same as I did. Only the python-keyring package already was installed. I note the following differences:
After I reinstalled python-secretstorage (which I removed yesterday because WITH it nagstamon.py did not start at all) and disabled autologin after a reboot and password-based login magically the nagstamon entry appeared in seahorse when being set in nagstamon settings.
|
|
I tested with MacOS X and Windows. After manually installing Python keyring it works on both platforms. So only some more finish is needed:
|
|
The auto-login would prevent the secret storage from providing the automatic Login keyring. This is unlocked automatically by the system using your login password which obviously isn't entered if the auto-login is enabled. Hence it would need a manually set up keyring which is why you were getting the prompt to create a new keyring. Glad it's working though. I've removed the VM image since it's no longer required. I agree some more work to tidy this up is required, this was mainly a proof of concept to show it working but also fall-back to the current obfuscation method if a keyring was not available. I'd also recommend you consider whether anything else should be securely stored (e.g. the proxy password). For linux it might be worth adding the python-keyring as a dependency to the DEB package. The python-keyring package depends on python-secretstorage so if python-keyring is installed then this should be to. |
|
I was able to remove python-secretstorage without interfering with python-keyring on ubuntu and Fedora, so a dependency would be necessary. I will check with Debian too but think their latest incarnation with GNOME3 should have the secretstorage. |
|
Finally I think I finetuned your feature enough. Commit 8cbaf8e brings the seamless migration from old storage to new one. Windows and OSX get the keyring module integrated within Nagstamon, Linux should have it by distribution and if not, the keyring won't be used. If you can try it on other systems to see if it works reliable. |
As per issue 66.
Below is a working example of the changes I made to implement secure password storage. The changes have been tidied up to not be such a nasty hack.
The keyring_available flag is set if the keyring module is available for import on the user's system AND a suitable default implementation for secure storage of credentials exists.
The main load & save server config sections have been modified to use the keyring module for secure password storage if available (ensuring an empty string is written to the config file for the password). If the module is not available then the current obfuscation implementation will be used. If the user does not enable the save password option then nothing will be stored using either method.
Note the or "" on line 326 is necessary for Nagstamon to handle the case where the keyring should be used but no password has yet been saved to the user's credential store. As a matter of personal preference I've disabled storage of empty password values to the keyring.