Jump to content
From ArchWiki

KDE Wallet Manager is a tool to manage passwords on the KDE Plasma system. By using the KWallet subsystem it not only allows you to keep your own secrets but also to access and manage the passwords of every application that integrates with KWallet.

Note: Since KDE Frameworks 5.97.0 KDE Wallet supports org.freedesktop.secrets DBus API and can now be used by libsecret for storing and retrieving passwords and other secrets using the Secret Service API.

## Unlock KDE Wallet automatically on login

To unlock KDE Wallet automatically on login, install kwallet-pam for the PAM compatible module. The chosen KWallet password must be the same as the current user password.

Note:

- kwallet-pam is not compatible with GnuPG keys, the KDE Wallet must use the standard `blowfish` encryption.
- When using autologin, the wallet can only be unlocked if the autologin method saves the password. pam_autologin does, for example.
- The wallet cannot be unlocked when using a fingerprint reader to login
- The wallet must be named `kdewallet` (default name). It does not unlock any other wallet(s).
- If using KDE, one may want to disable Close when last application stops using it in KDE Wallet settings to prevent the wallet from being closed after each usage (WiFi-passphrase unlock, etc.).
- It may be needed to remove the default created wallet first, thus removing all stored entries.
- If the kwallet Migration Assistant asks for a password after every login, rename or delete the `~/.kde4/share/apps/kwallet` folder.

Optionally install kwalletmanager for the wallet management tool. This tool can be used to create a KDE Wallet with `blowfish` encryption and more settings not provided by the kcm-module.

Tip: An alternative is to use KWalletManager and set an empty Kwallet-password, thus preventing the need of entering a password to unlock a wallet. Simply do not enter a password on both fields in Change Password... This may however lead to unwanted (read/write) access to the user's wallet. Enabling Prompt when an application accesses a wallet under Access Control is highly recommended to prevent unwanted access to the wallet.

### Configure PAM

The following lines must be present under their corresponding sections:

    auth            optional        pam_kwallet5.so
    session         optional        pam_kwallet5.so auto_start

Edit the PAM configuration corresponding to your situation:

- For SDDM no further edits should be needed because the lines are already present in `/etc/pam.d/sddm`.
- For GDM edit `/etc/pam.d/gdm-password` accordingly.
- For greetd edit `/etc/pam.d/greetd` accordingly.
- For LightDM edit `/etc/pam.d/lightdm` and `/etc/pam.d/lightdm-autologin` files:
- For unlocking on tty login (no display manager), edit `/etc/pam.d/login` accordingly. You will need to specify the force_run parameter.

    /etc/pam.d/login

    auth            optional        pam_kwallet5.so
    session         optional        pam_kwallet5.so auto_start force_run

    /etc/pam.d/lightdm

    #%PAM-1.0
    auth            include         system-login
    auth            optional        pam_kwallet5.so

    account         include         system-login

    password        include         system-login

    session         include         system-login
    session         optional        pam_kwallet5.so auto_start

    /etc/pam.d/lightdm-autologin

    #%PAM-1.0
    auth        required    pam_env.so
    auth        required    pam_faillock.so preauth
    auth        required    pam_shells.so
    auth        required    pam_nologin.so
    auth        [success=1 default=ignore]  pam_succeed_if.so user ingroup autologin
    auth        required    pam_unix.so
    auth        required    pam_permit.so
    auth        optional    pam_kwallet5.so

    account     include     system-local-login

    password    include     system-local-login

    session     include     system-local-login
    session     optional    pam_kwallet5.so auto_start

    /etc/pam.d/greetd

    #%PAM-1.0

    auth       required     pam_securetty.so
    auth       requisite    pam_nologin.so
    auth       include      system-local-login
    auth       optional     pam_kwallet5.so
    account    include      system-local-login
    session    include      system-local-login
    session    optional     pam_kwallet5.so auto_start force_run

## Using the KDE Wallet to store ssh key passphrases

Note: An SSH agent should be up and running.

Install ksshaskpass package.

Create an autostart .desktop file:

    ~/.config/autostart/ssh-add.desktop

    [Desktop Entry]
    Exec=ssh-add -q
    Name=ssh-add
    Type=Application

Tip: By default, ssh-add(1) will only add the default key `~/.ssh/id_rsa`. Assuming you have different SSH keys named `key1`, `key2`, `key3` in `~/.ssh/`, you may add them automatically on login by passing them as arguments to ssh-add. E.g.:

    ~/.config/autostart/ssh-add.desktop

    [Desktop Entry]
    Exec=ssh-add -q .ssh/key1 .ssh/key2 .ssh/key3
    Name=ssh-add
    Type=Application

To use shell features like globbing, change the `Exec=` line to start the shell and execute the ssh-add command with it. For example, to add all private keys whose file names start with `id` to ssh-add using the extended globbing features of Zsh:

    ~/.config/autostart/ssh-add.desktop

    [Desktop Entry]
    Exec=zsh --extendedglob -c 'ssh-add -q ~/.ssh/id^*.pub < /dev/null'
    Name=ssh-add
    Type=Application
    X-KDE-AutostartScript=true

You also have to set the `SSH_ASKPASS` environment variable to `ksshaskpass` and `SSH_ASKPASS_REQUIRE` to `prefer` (prefer to use the askpass program instead of the TTY). To set it automatically on each login, create the following systemd environment file:

    ~/.config/environment.d/ssh_askpass.conf

    SSH_ASKPASS='/usr/bin/ksshaskpass'
    SSH_ASKPASS_REQUIRE=prefer

It will ask for your password and unlock your SSH keys. Upon restart your SSH keys should be unlocked once you give your kwallet password.

To add a new key and store the password with kwallet use the following command

    $ ssh-add /path/to/new/key </dev/null

and append the key to the list of keys in `~/.config/autostart/ssh-add.desktop` as explained above to have it unlocked upon providing the kwallet password.

## Using the KDE Wallet to store Git credentials

Git can delegate credential handling to a credential helper. By using ksshaskpass as a credential helper, the HTTP/HTTPS and SMTP passwords can be safely stored in the KDE Wallet.

Install the ksshaskpass package.

Configure Git by setting the `GIT_ASKPASS` environment variable:

    ~/.config/environment.d/git_askpass.conf

    GIT_ASKPASS='/usr/bin/ksshaskpass'

Tip: If the `SSH_ASKPASS` environment variable is set to ksshaskpass, then additionally setting `GIT_ASKPASS` is not required.

See gitcredentials(7) for alternatives and more details.

## KDE Wallet for Chrome and Chromium

Chrome/Chromium/Opera has built in wallet integration. To enable it, run Chromium with the `--password-store=kwallet5` or `--password-store=detect` argument. To make the change persistent, see Chromium#Making flags persistent. (Setting CHROMIUM_USER_FLAGS will not work.)

## Query passwords from the terminal

Instead of storing passwords in plain text files, you can manually add new entries in your wallet and retrieve them with kwallet-query.

For example, if you want to log into the Docker Hub registry with Podman, which supports getting the passwords from stdin with the `--password-stdin` flag, you can use the following command to login:

    $ kwallet-query -r folder_entry wallet_name -f folder_name | podman login docker.io -u dockerhub_username --password-stdin

This way, your password is not stored in any text file and neither is it stored in the terminal history file.

## Unlocking KWallet automatically in a window manager

To unlock KWallet protected by the login password, it is necessary to add

    exec --no-startup-id /usr/lib/pam_kwallet_init

to the configuration file of the window manager in addition to configuring PAM.

## Disable KWallet

In case you want to permanently disable kwallet:

    ~/.config/kwalletrc

    [Wallet]
    Enabled=false

## Automatic D-Bus activation

Most applications use `org.freedesktop.secrets.service` D-Bus service. KWallet does not provide a service file for it out of the box.

You can achieve automatic activation by creating such service file:

    ~/.local/share/dbus-1/services/org.freedesktop.secrets.service

    [D-BUS Service]
    Name=org.freedesktop.secrets
    Exec=/usr/bin/kwalletd5

## See also

- Unlocking KWallet with PAM
- org.freedesktop.secrets DBus API initial support

Category:

- KDE