KDE graphical apps do not respect keyring / ssh-agent added via keychain (keychain works in shell correctly)

I have also found this report for Wayland: https://bugzilla.opensuse.org/show_bug.cgi?id=1088564#c24

Good find!

Looks like a general packaging and/or system setup issue if other distributions have it as well.

1 Like

Ahh so itā€™s not Neon-specific, itā€™s X11-specific. So, no harm to continue with keychain then.

I checked this out on tumbleweed and saw that autostarting for X11 isnā€™t part of the package containing ssh-agent, or X11, itā€™s actually part of the DM. So I guess itā€™s down to whether the DM implements it.

Iā€™m familiar with that thread, read it back when I set up this machineā€™s agent (itā€™s tumbleweed). Youā€™ll notice that it mentioned both of the solutions I recommended to you, the kwin env script, and the systemd service.

As mentioned in that thread, the kwin env script is the ā€˜officialā€™ way to do this. Iā€™m near-certain Iā€™ve seen docs on kde.org about it. I did search for them again but all I find are discuss threads about it :laughing: with links elsewhere that lead to the same suggestions Iā€™ve given you.

Fedoraā€™s service is linked there but it wonā€™t exactly work because their ssh-agent is different to everyone elseā€™s (built from unique source code), so systemd socket activation works for them but not most distros (sad). If you wanted to go that route, Iā€™d offer you a different service unit file, but using a systemd service seems contrary to using keychain since itā€™s supposed to be long-running all by itself, and, the env script is way easier.

So, now you know why Iā€™ve been saying what I have :slight_smile: Iā€™m more confident than ever that Iā€™ve been giving you the right advice. Of course if you werenā€™t glued to keychain you could just copypaste all the solutions in the linked threads, start ssh-agent like that, and use ssh-add to add your keys to it.

You just need to adapt the upstream advice Iā€™m passing on to you, regarding ssh-agent, into something appropriate for keychain. The way to get keychain to act like ssh-agent does, where it outputs commands for setting environment variables, is that --eval option. Itā€™s in the manpage. I donā€™t know why yours locked up, but it should only take seconds to try it in a terminal and get it right and then paste that into that kwin env shell script.

1 Like

So, no, unfortunately, trying to create a kwin script with the content:
eval $(keychain --eval --quiet ~/.ssh/id_rsa ~/.ssh/github_rsa ~/.ssh/id_rsa.work)
as suggested above just blocks Plasma/KDE from booting and SDDM is shown after a short while again for login. I had to delete the script to make KDE/Plasma boot.

I suspect this is due to keychain/ssh-agent requiring password input before further processing.

So, no go.

Yes, it could be that some of the keys in your list have a password.

This would also make ssh-agent behave that way.

You will either need to remove the passwords or add the keys in an interactive shell that can ask for input.

E.g. the keychain equivalent to ssh-add

Locate ksshaskpass, if not found install it
which ksshaskpass

Create this script in your home dir and make is executable:

#!/bin/bash
SSH_ASKPASS=/usr/bin/ksshaskpass
ssh-add ~/.ssh/private_key

Replace /usr/bin/ksshaskpass with the output of which ksshaskpass and if there is no output install ksshaskpass with sudo apt install ksshaskpass and try again.

Replace private_key with your SSH private key file name which is to be added.

chmod your script with chmod 500 ~/.ssh/ssh-add.sh to make it read-only and executable for yourself.

In System Settings head to Startup and Shutdown -> Autostart and add this script there as ā€œlogin scriptā€.

Log out and log in again, fire up terminal and run ssh-add -l to verify it works.

Did you try

ā€“noask
This option tells keychain do everything it normally does (ensure ssh-agent is running, set up the ~/.keychain/[hostname]-{c}sh files) except that it will not prompt you to add any of the keys you specified if they havenā€™t yet been added to ssh-agent.

Will try both of your suggestions, thanks.