How do I unlock KeePassXC at login?

[droidmonkey]

If you are using Linux your can use secret-tool such as:
secret-tool lookup name keepass | keepassxc --pw-stdin --keyfile /path/to/keyfile /path/to/database.kdbx

[michaelk83]

This solution assumes that the KPXC password is stored in a 3rd party Secret Service keyring such as Gnome-keyring. That's what secret-tool reads. This won't work if KPXC is the Secret Service keyring (via "Enable Secret Service integration" option), since that'll cause a circular dependency: you'd need to unlock KPXC to read the password to unlock KPXC.

In the latter case, you can still use a keyfile without an additional password (I think):
keepassxc --keyfile /path/to/keyfile /path/to/database.kdbx

There was some discussion of implementing a PAM module for this (in issue #6055 and others), but nothing implemented yet. The team's consensus is that using (only) one's login password to unlock KPXC is poor practice.

(Thought this was worth mentioning given that this Q&A is aimed at the end users.)

[62f]

Doesn't exit to prompt in Alpine

```~ # apk search secret-tool libsecret-0.20.5-r0 ~ # apk add libsecret (1/3) Installing libgpg-error (1.45-r0) (2/3) Installing libgcrypt (1.10.1-r0) (3/3) Installing libsecret (0.20.5-r0) Executing busybox-1.35.0-r17.trigger OK: 174 MiB in 127 packages ~ # secret-tool lookup name keepass | ke epassxc --pw-stdin --keyfile /path/to/ke yfile /path/to/database.kdbx secret-tool: Cannot spawn a message bus without a machine-id: Unable to load /var/lib/dbus/machine-id or /etc/machine-id: Failed to open file “/var/lib/dbus/machine-id”: No such file or directory qt.qpa.xcb: could not connect to display qt.qpa.plugin: Could not load the Qt platform plugin "xcb" in "" even though it was found. This application failed to start because no Qt platform plugin could be initialized. Reinstalling the application may fix this problem.

Available platform plugins are: eglfs, linuxfb, minimal, minimalegl, offscreen, vnc, wayland-egl, wayland, wayland-xcomposite-egl, wayland-xcomposite-glx, xcb.

Aborted ```

[dretechtips]

If you are using Linux your can use secret-tool such as:
secret-tool lookup name keepass | keepassxc --pw-stdin --keyfile /path/to/keyfile /path/to/database.kdbx

How would you do this for keepassxc-cli. It doesn't look like there's an argument flag for this in the man page .

[droidmonkey]

pipe the password to keepassxc-cli open <db_path>. You might have to include a newline.

[dretechtips]

I pipe in the password, however the shell just exists right away and doesn't allow me to input anything into the unlocked database shell.

[droidmonkey]

Sounds more like a problem with how you are launching the shell.

[dretechtips]

I type in echo "[PASSWORD]" | keepassxc-cli open --key-file "[KEYFILE PATH]" [DATABASE_PATH]

Output:
Passwords>%
[Exits immediately]
$

[droidmonkey]

Interesting, will have to look into that

[fertkir]

I've created a script which unlocks KeePassXC at login using password from keyring:
https://github.com/fertkir/linux-utils/tree/main/keepassxc-unlocker

[fertkir]

@droidmonkey, correct me if I'm wrong, but you're equally vulnerable if you use Gnome keyring, for example, to store your ssh key password. If you have Gnome keyring unlocked on login, any program can get passwords from it.

[droidmonkey]

Yes that is exactly correct. We offer an alternative to gnome keyring (that is the secret service api) which also allows for user confirmation before granting access and you can lock your database in between uses.

[michaelk83]

We offer an alternative to gnome keyring (that is the secret service api) which also allows for user confirmation before granting access

Except, you can't use it to retrieve the passphrase to auto-unlock the very database where that passphrase is stored (as I noted earlier). You could put that passphrase in a separate database, but then you may as well just use the AutoOpen feature, and you'd still need to unlock that separate database first, somehow.

Back to Gnome keyring, you could somewhat reduce the vulnerability by having it auto-lock after a while (if they support that), but that rather defeats the purpose of the auto-unlock, at least for some use cases. Still could be useful for the initial logins during startup, or to initialize QuickUnlock, once that is implemented on Linux.

[droidmonkey]

Except, you can't use it to retrieve the passphrase to auto-unlock the very database where that passphrase is stored (as I noted earlier).

I wasn't suggesting to do that

[michaelk83]

Also, you can't run Gnome keyring and KeePassXC' Secret Service integration at the same time. So if you want to use Gnome keyring to auto-unlock KeePassXC, then you can't use KeePassXC' Secret Service integration; and vice versa.

[Kyr4l]

If you are using Linux your can use secret-tool such as: secret-tool lookup name keepass | keepassxc --pw-stdin --keyfile /path/to/keyfile /path/to/database.kdbx

can someone please help me with this ? i've been looking for hours for a solution and i can't find antyhing that actually works
i've added a folder in my kdewallet named keepass with a password entry but whater i do secret-tool won't return anything. i'm so tired i don't understand how this awful tool works

[62f]

You’re still using openSUSE? Don’t SUSE still have an Optional paywall support? Cool avatar, BtW.

[Kyr4l]

i use tumbleweed yes

Don’t SUSE still have an Optional paywall support

paywall support ? what ?